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Executive  Summary 


On  September  8,  1994,  about  1903:23  eastern  daylight  time,  USAir  (now  US 
Airways)  flight  427,  a  Boeing  737-3B7  (737-300),  N513AU,  crashed  while  maneuvering 
to  land  at  Pittsburgh  International  Airport,  Pittsburgh,  Pennsylvania.  Flight  427  was 
operating  under  the  provisions  of  14  Code  of  Federal  Regulations  Part  121  as  a  scheduled 
domestic  passenger  flight  from  Chicago-O'Hare  International  Airport,  Chicago,  Illinois,  to 
Pittsburgh.  The  flight  departed  about  1810,  with  2  pilots,  3  flight  attendants,  and  127 
passengers  on  board.  The  airplane  entered  an  uncontrolled  descent  and  impacted  terrain 
near  Aliquippa,  Pennsylvania,  about  6  miles  northwest  of  the  destination  airport.  All  132 
people  on  board  were  killed,  and  the  airplane  was  destroyed  by  impact  forces  and  fire. 
Visual  meteorological  conditions  prevailed  for  the  flight,  which  operated  on  an  instrument 
flight  rules  flight  plan. 

The  National  Transportation  Safety  Board  determines  that  the  probable  cause  of 
the  USAir  flight  427  accident  was  a  loss  of  control  of  the  airplane  resulting  from  the 
movement  of  the  rudder  surface  to  its  blowdown  limit.  The  rudder  surface  most  likely 
deflected  in  a  direction  opposite  to  that  commanded  by  the  pilots  as  a  result  of  a  jam  of  the 
main  rudder  power  control  unit  servo  valve  secondary  slide  to  the  servo  valve  housing 
offset  from  its  neutral  position  and  overtravel  of  the  primary  slide. 

The  safety  issues  in  this  report  focused  on  Boeing  737  rudder  malfunctions, 
including  rudder  reversals;  the  adequacy  of  the  737  rudder  system  design;  unusual  attitude 
training  for  air  carrier  pilots;  and  flight  data  recorder  (FDR)  parameters. 

Safety  recommendations  concerning  these  issues  were  addressed  to  the  Federal 
Aviation  Administration  (FAA).  Also,  as  a  result  of  this  accident,  the  Safety  Board  issued 
a  total  of  22  safety  recommendations  to  the  FAA  on  October  18,  1996,  and  February  20, 
1997,  regarding  operation  of  the  737  rudder  system  and  unusual  attitude  recovery 
procedures.  In  addition,  as  a  result  of  this  accident  and  the  United  Airlines  flight  585 
accident  (involving  a  737-291)  on  March  3,  1991,  the  Safety  Board  issued  three 
recommendations  (one  of  which  was  designated  “urgent”)  to  the  FAA  on  February  22, 
1995,  regarding  the  need  to  increase  the  number  of  FDR  parameters. 
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AAIB 

Air  Accidents  Investigation  Branch 

AC 

advisory  circular 

AGO 

Aircraft  Certification  Office 

AD 

airworthiness  directive 

AFIP 

Armed  Forces  Institute  of  Pathology 

AFA 

Air  Force  Academy 

AFM 

airplane  flight  manual 

AFS 

auto-flight  system 

agl 

above  ground  level 

ALFA 

Air  Line  Pilots  Association 

APU 

auxiliary  power  unit 

ARAC 

Aviation  Rulemaking  Advisory  Committee 

ASB 

Alert  Service  Bulletin 

ASRS 

Aviation  Safety  Reporting  System 

ATC 

air  traffic  control 

ATP 

airline  transport  pilot 

ATR 

Avions  de  Transport  Regional 

BAC 

British  Aerospace  Corporation 

BWI 

Baltimore-Washington  International  Airport 

CAM 

cockpit  area  microphone 

CAMI 

Civil  Aeromedical  Institute 

CDR 

critical  design  review 

CFR 

Code  of  Federal  Regulations 

CMD 

command  (autopilot  mode) 

CRM 

crew  resource  management 

CVR 

cockpit  voice  recorder 

CWS 

control  wheel  steering  (autopilot  mode) 

DER 

Designated  Engineering  Representative 

DNA 

deoxyribonucleic  acid 

DOT 

Department  of  Transportation 
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EDP 

EDS 

E/Ebay 

EGT 

EMI 

EPR 

F 

FAA 

FAR 

FBI 

FD 

FDAU 

FDR 

FL 

FSIB 

GPR 

GPWS 

HBAT 

fflRF 

Hg 

HRC 

Hz 

IFR 

lOE 

IRS 

KCAS 

KIAS 

LIDAR 

LOFT 

LVDT 

LWD 


engine-driven  hydraulic  pump 
energy  dispersive  x-ray  spectrum 
electrical/electronic  compartment 
exhaust  gas  temperature 
electromagnetic  interference 
engine  pressure  ratio 

Fahrenheit 

Federal  Aviation  Administration 

Federal  Aviation  Regulations 

Federal  Bureau  of  Investigation 

flight  director 

flight  data  acquisition  unit 

flight  data  recorder 

flight  level 

Flight  Standards  Information  Bulletin 

ground  penetration  radar 
ground  proximity  warning  system 

Handbook  Bulletin  for  Air  Transportation 
High-intensity  radiated  fields 
mercury 

Hardness  Rockwell  C  (scale) 

Hertz 

instrument  flight  rules 
initial  operating  experience 
inertial  reference  system 

knots  calibrated  airspeed 
knots  indicated  airspeed 

Light  Distancing  and  Ranging 
line-oriented  flight  training 
linear  variable  displacement  transducer 
left  wing  down 
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M-CAB 

multipurpose  cab  (simulator) 

MCP 

mode  control  panel 

MM 

Maintenance  Manual 

MPD 

Maintenance  Planning  Document 

MRB 

Maintenance  Review  Board 

MSG-3 

Maintenance  Steering  Group  3 

msl 

mean  sea  level 

N1 

engine  fan  speed 

N2 

engine  compressor  speed 

NAS 

National  Aerospace  Standard 

NASA 

National  Aeronautics  and  Space  Administration 

NCAR 

National  Center  for  Atmospheric  Research 

NG 

next  generation 

nm 

nautical  mile 

NOAA 

National  Oceanic  and  Atmospheric  Administration 

NPRM 

notice  of  proposed  rulemaking 

NTSB 

National  Transportation  Safety  Board 

OEM 

original  equipment  manufacturer 

ORD 

Chicago-0 ’Hare  International  Airport 

OSHA 

Occupational  Safety  and  Health  Administration 

OTS 

Officer  Training  School 

PA 

public  address 

PADDS 

portable  airborne  digital  data  system 

PC 

production  certificate 

PCU 

power  control  unit 

PF 

pilot  flying 

PIT 

Pittsburgh  International  Airport 

PIT  TRACON 

Pittsburgh  terminal  radar  approach  control 

PMA 

parts  manufacturing  approval 

P/N 

part  number 

PNF 

pilot  not  flying 

POI 

principal  operations  inspector 

PPE 

personal  protective  equipment 

PSA 

Pacific  Southwest  Airlines 

psi 

pounds  per  square  inch 
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QAR 

quick  access  recorder 

RA 

radio  altitude 

RWD 

right  wing  down 

SAE 

Society  of  Automotive  Engineers 

SB 

service  bulletin 

SEM 

scanning  electron  microscope 

SET 

special  events  training 

SEAR 

Special  Federal  Aviation  Regulation 

SL 

service  letter 

S/N 

serial  number 

TOGA 

takeoff/go-around 

T/R 

thrust  reverser 

UCP 

Unified  Command  Post 

USAF 

U.S.  Air  Force 

VFR 

visual  flight  rules 

VMS 

vertical  motion  simulator 

WSFO 

Weather  Service  Forecast  Office 

WSR-88D 

Weather  Surveillance  Radar 
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Giossary  of  Terms 


Acceptance  Test  Procedure  (for  the  Boeing  737  main  rudder  power  control  unit):  A 

series  of  post-production  functional  tests  used  by  Parker  Hannifin  Corporation  to 
measure  the  performance  of  the  main  rudder  power  control  unit  (PCU). 

Actuator:  A  device  that  transforms  fluid  pressure  into  mechanical  force. 

Adverse  tolerance  buildup:  A  description  for  a  condition  in  which  the  assembling 
(stacking)  of  a  series  of  parts,  all  of  which  are  individually  built  within  tolerances  (that 
is,  within  an  allowable  deviation  from  a  standard),  has  an  adverse  result. 

Aileron:  An  aerodynamic  control  surface  that  is  attached  to  the  rear,  or  trailing,  edges  of 
each  wing.  When  commanded,  the  ailerons  rotate  up  or  down  in  opposite  directions. 

Auto-flight  system:  A  system,  consisting  of  the  autopilot  flight  director  system  and  the 
autothrottle,  that  provides  control  commands  to  the  airplane’s  ailerons,  flight  spoilers, 
pitch  trim,  and  elevators  to  reduce  pilot  workload  and  provide  for  smoother  flight.  The 
auto-flight  system  does  not  provide  control  commands  to  the  737  airplane’s  rudder 
system. 

Bank:  The  attitude  of  an  airplane  when  its  wings  are  not  laterally  level. 

Block  maneuvering  speed:  The  recommended  maneuvering  speeds  for  each  flap 
configuration  that  provide,  for  all  airplane  weights,  adequate  airspeed  for  maneuvering 
in  at  least  a  40°  bank  without  activation  of  the  stickshaker.  The  “block”  term 
simplified  the  concept  so  that  a  single  airspeed  was  specified  for  all  airplane  weights 
less  than  117,000  pounds;  thus,  airplanes  operating  at  weights  lighter  than  117,000 
pounds  (such  as  the  USAir  flight  427  accident  airplane)  had  a  greater  maneuvering 
margin. 

Blowdown  limit:  The  maximum  amount  of  rudder  travel  available  for  an  airplane  at  a 
given  flight  condition/configuration.  Rudder  blowdown  occurs  when  the  aerodynamic 
forces  acting  on  the  rudder  become  equal  to  the  hydraulic  force  available  to  move  the 
rudder. 

Blue  water:  Lavatory  fluid.  Boeing’s  Blue  Water  Assessment  Team  reviewed  fluid 
contamination  in  the  electrical/electronic  compartment  (E/E  bay)  from  various 
potential  sources,  including  lavatories,  galleys,  rainwater,  and  condensation. 

Catastrophic  failure  condition:  A  failure  condition  that  will  prevent  continued  safe 
flight  and  landing.  (Source:  Federal  Aviation  Administration  Advisory  Circular 
25.1309-lA.) 

Command  mode:  A  position  on  the  two  autopilot  flight  control  computers  that,  when 
engaged,  allows  the  autopilot  to  control  the  airplane  according  to  the  mode  selected 
via  the  Mode  Selector  Switches,  which  include  Altitude  Hold,  Vertical  Speed,  Level 
Change,  Vertical  Navigation,  VOR  Localizer,  Lateral  Navigation,  and  Heading  Select. 
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Compliance  (when  referring  to  PCU  linkages);  The  elastic  deformation  of  PCU  internal 
input  linkages  that  does  not  damage  the  linkages  but  allows  additional  motion. 

Computer  simulation;  A  term  in  this  accident  report  that  refers  to  models  of  the  USAir 
flight  427,  United  flight  585,  and  Eastwind  flight  517  upsets  that  were  used  to  develop 
potential  accident  scenarios.  The  Safety  Board’s  computer  workstation-based  flight 
simulation  software  used  flight  controls,  aerodynamic  characteristics,  and  engine 
models  (developed  by  Boeing)  to  derive  force  and  moment  time  histories  of  the 
airplanes.  The  Board  developed  its  own  equations  to  convert  these  forces  and 
moments  into  airplane  motion.  Boeing  performed  similar  flight  simulations  on  its  own 
computer  workstations. 

Control  wheel  steering  mode;  A  position  on  the  two  autopilot  flight  control  computers 
that,  when  engaged,  allows  the  autopilot  to  maneuver  the  airplane  through  the 
autoflight  system  in  response  to  control  pressure,  similar  to  that  required  for  manual 
flight,  applied  by  either  pilot.  The  use  of  control  wheel  steering  does  not  disengage  the 
autopilot. 

Cross-coupled;  The  ability  of  the  aerodynamic  motion  about  an  airplane’s  control  axes  to 
constantly  interact  and  affect  each  other  in  flight. 

Crossover  airspeed;  The  speed  below  which  the  maximum  roll  control  (full  roll  authority 
provided  by  control  wheel  input)  can  no  longer  counter  the  yaw/roll  effects  of  a  rudder 
deflected  to  its  blowdown  limit. 

Directional  control:  The  function  that  is  normally  performed  by  the  rudder  by  pilot  input 
or  yaw  damper  input.  (Also  known  as  yaw  control.) 

Dual  jam  (as  used  in  this  accident  report):  The  simultaneous  jams  of  the  main  rudder 
PCU  primary  to  secondary  slides  and  the  secondary  slide  to  the  servo  valve  housing. 

Dutch  roll:  A  combination  yawing  and  rolling  oscillations  that  is  an  inherent 
characteristic  of  all  swept-wing  airplanes. 

E/E  bay:  An  airplane  compartment  that  contains  electrical  and  electronic  components. 

Elevator:  An  aerodynamic  control  surface  to  the  back  of  the  horizontal  stabilizer  that 
moves  the  airplane’s  nose  up  and  down  to  cause  the  airplane  to  climb  or  descend. 

Empennage:  The  tail  section  of  an  airplane,  including  stabilizing  and  flight  control 
surfaces. 

Extremely  improbable  failure  condition:  A  condition  that  is  so  unlikely  that  it  is  not 
anticipated  to  occur  during  the  entire  operational  life  of  all  airplanes  of  one  type  and 
that  has  a  probability  on  the  order  of  1  x  10'®  or  less  each  flight  hour  based  on  a  flight 
of  mean  duration  for  the  airplane  type.  (Source:  Federal  Aviation  Administration 
Advisory  Circular  25. 1309-1 A.) 

Flap:  An  extendable  aerodynamic  surface  usually  located  at  the  trailing  edge  of  an 
airplane  wing.  The  737  also  has  an  extendable  aerodynamic  surface  located  at  the 
wing’s  leading  edge,  which  is  called  a  Krueger  flap. 
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G:  A  unit  of  measurement.  One  G  is  equivalent  to  the  acceleration  caused  by  the  earth’s 
gravity  (32.174  feet/sec^). 

Galling:  A  condition  in  which  microscopic  projections  or  asperities  bond  at  the  sliding 
interface  under  very  high  local  pressure.  Subsequently,  the  sliding  forces  fracture  the 
bonds,  tearing  metal  from  one  surface  and  transferring  it  to  the  other. 

Heading:  The  direction  (expressed  in  degrees  between  001  and  360°)  in  which  the 
longitudinal  axis  of  an  airplane  is  pointing,  in  relation  to  north. 

Hinge  moment:  The  tendency  of  a  force  to  produce  movement  about  a  hinge;  specifically, 
the  tendency  of  the  aerodynamic  forces  acting  on  a  control  surface  to  produce  motion 
about  the  hinge  axis  of  the  surface. 

Hydraulic  fluid:  Liquid  used  to  transmit  and  distribute  forces  to  various  airplane 
components  that  are  being  actuated. 

Hydraulic  pressure  limiter:  A  device  incorporated  in  the  design  of  the  main  rudder  PCU 
on  all  737  next-generation  (NG)  series  airplanes  to  reduce  the  amount  of  rudder 
deflection  when  active.  It  is  commanded  to  limit  hydraulic  system  A  pressure  (using  a 
bypass  valve)  as  the  airspeed  is  increased  to  greater  than  137  knots,  and  it  is  reset  as 
the  airspeed  is  decreased  to  less  than  139  knots. 

Hydraulic  pressure  reducer:  A  modification  on  737-100  through  -500  series  airplanes  to 
reduce  the  amount  of  rudder  authority  available  during  those  phases  of  flight  when 
large  rudder  deflections  are  not  required.  The  pressure  reducer,  added  to  hydraulic 
system  A  near  the  rudder  PCU,  will  lower  the  hydraulic  pressure  from  3,000  to  1,000 
pounds  per  square  inch  (psi)  on  737-300,  -400,  and  -500  series  airplanes  or  to  1,400 
psi  on  737-100,  and  -200  series  airplanes. 

Hydraulic  system  A  (for  737-300,  -400,  and  -500  series  airplanes):  A  system  that 
includes  an  engine-driven  hydraulic  pump  and  an  electrically  powered  pump  that 
provides  power  for  the  ailerons,  rudder,  elevators,  landing  gear,  normal  nosewheel 
steering,  alternate  brakes,  inboard  flight  spoilers,  left  engine  thrust  reverser,  ground 
spoilers,  the  system  A  autopilot,  and  the  autoslats  through  the  power  transfer  unit. 

Hydraulic  system  B  (for  737-300,  -400,  and  -500  series  airplanes):  A  system  that 
includes  an  engine-driven  hydraulic  pump  and  an  electrically  powered  pump  that 
provides  power  for  the  ailerons,  rudder,  elevators,  trailing  edge  flaps,  leading  edge 
flaps  and  slats,  autoslats,  normal  brakes,  outboard  flight  spoilers,  right  thrust  reverse, 
yaw  damper,  the  system  B  autopilot,  autobrakes,  landing  gear  transfer  unit,  and 
alternate  nose-wheel  steering  (if  installed). 

Input  shaft  (of  the  737  main  rudder  PCU):  When  rudder  motion  is  commanded,  this 
device  moves  the  primary  and  secondary  dual-concentric  servo  valve  slides  by  way  of 
the  primary  and  secondary  internal  summing  levers  to  connect  hydraulic  pressure  and 
return  circuits  from  hydraulic  systems  A  and  B  so  that  hydraulic  pressure  is  ported  to 
the  appropriate  sides  of  the  dual  tandem  actuator  piston  to  extend  or  retract  the  main 
rudder  PCU  piston  rod. 

Interpolation:  The  determination,  or  approximation,  of  unknown  values  based  on  known 
values. 
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Iteration:  A  process  used  by  the  Safety  Board  that  includes  repeating  Board  computer 
simulations  to  compare  the  flights  of  USAir  flight  427,  United  Airlines  flight  585,  and 
Eastwind  Airlines  flight  517  with  available  flight  data  recorder  (FDR)  data  from  those 
flights.  The  simulation  process  includes  inputting  assumed  flight  control  surface 
(aileron,  rudder,  and  elevator)  positions,  running  the  flight  simulations,  and  comparing 
the  output  of  the  simulations  (for  example,  altitude,  airspeed,  and  heading)  with  FDR 
data. 

Kinematics:  A  process  used  by  Boeing  and  the  Safety  Board  that  involves  fitting  curves 
through  available  FDR  data  (such  as  heading,  pitch,  and  roll),  obtaining  flight  control 
time  history  rates  from  these  curves,  and  obtaining  accelerations  from  these  rates. 
Forces,  moments,  and  aerodynamic  coefficients  are  then  obtained  from  these 
accelerations  using  Newton’s  Laws. 

Knot:  A  velocity  of  1  nautical  mile  per  hour. 

Linear  variable  displacement  transducer:  An  electromechanical  device  that  measures 
linear  movement  and  converts  the  measurement  into  an  electrical  signal  (output 
voltage)  that  relates  position  to  signal.  In  the  737  main  rudder  PCU,  it  is  used  to  sense 
the  yaw  damper  position.  (Also  referred  to  as  a  linear  variable  displacement 
transformer.) 

M-CAB:  A  Boeing  multipurpose  cab  flight  simulator  that  can  be  modified  to  simulate  a 
variety  of  aircraft  models  and  scenarios.  It  is  an  engineering  simulator  that  is  capable 
of  simulating  events  that  are  outside  of  normal  flight  regimes,  but  it  is  not  used  for 
flight  training. 

Metering  edges:  The  sides  of  grooves  that  are  cut  into  the  land  surface  of  the  primary  or 
secondary  slides  of  the  main  rudder  PCU  servo  valve.  Flow  of  hydraulic  fluid  is 
controlled  by  positioning  a  metering  edge  relative  to  a  metering  port  (that  is,  a 
rectangular  hole  in  the  valve  housing  and  secondary  slide  through  which  hydraulic 
fluid  flows).  Metering  occurs  when  the  metering  edge  opens  and  closes  the  metering 

port. 

Minimum  tolerance  servo  valve:  A  servo  valve  used  by  Boeing  during  thermal  shock 
testing  (for  this  accident  investigation)  because  it  had  the  tightest  diametric  clearances 
(between  the  primary  and  secondary  slides  and  the  secondary  slide  and  valve  housing) 
that  would  pass  the  PCU  acceptance  test  procedure  friction  requirements. 

NG;  Boeing’s  next-generation  737  series,  designated  as  the  737-600,  -700,  -800,  and  -900 
models. 

Overtravel:  The  ability  of  a  device  to  move  beyond  its  normal  operating  position  or 
range.  Within  the  main  rudder  PCU  servo  valve,  overtravel  of  the  primary  or 
secondary  slides  would  be  the  result  of  elastic  deformation  of  the  mechanical  input 
mechanism. 

Pitch  control:  The  function  that  is  performed  by  the  elevator  by  moving  the  control 
column  forward  or  aft,  which  raises  or  lowers  the  nose  of  the  airplane. 

Portable  airborne  digital  data  system:  A  self-contained  flight  test  data  recording  system 
developed  by  Boeing  that  was  installed  on  a  flight  test  airplane  to  record  parameters 


Glossary  of  Terms 


xix 


Aircraft  Accident  Report 


needed  to  evaluate  airplane  performance.  For  US  Air  427  and  Eastwind  517  flight 
testing,  the  system  recorded  all  data  at  a  sampling  rate  of  20  times  per  second. 

Power  control  unit  (PCU):  A  hydraulically  powered  device  that  moves  a  control  surface, 
such  as  a  rudder,  elevator,  and  aileron. 

Roll:  Rotation  of  an  airplane  about  its  longitudinal  axis. 

Roll  control:  The  function  that  is  performed  by  the  ailerons  and  flight  spoilers  by  moving 
the  control  wheel  to  the  right  or  the  left. 

Rotor  (when  referring  to  weather):  An  atmospheric  disturbance  produced  by  high 
winds,  often  in  combination  with  mountainous  terrain,  and  expressed  by  a  rotation  rate 
(in  radians  per  second),  a  core  radius  (in  feet),  and  a  tangential  speed  (in  feet  per 
second).  Rotation  can  occur  around  a  horizontal  or  vertical  axis. 

Rudder:  An  aerodynamic  vertical  control  surface  that  is  used  to  make  the  airplane  yaw,  or 
rotate,  about  its  vertical  axis. 

Rudder  control  quadrant:  A  device  in  the  rudder  system  that  connects  rudder  cables  to 
control  rods  to  transmit  rudder  system  inputs. 

Reverse  rudder  response:  A  rudder  surface  movement  that  is  opposite  to  the  one 
commanded. 

Rudder  hardover:  The  sustained  deflection  of  a  rudder  at  its  full  (blowdown)  travel 
position. 

Rudder  trim:  A  system  that  allows  the  pilots  to  command  a  steady  rudder  input  without 
maintaining  foot  pressure  on  the  rudder  pedals.  It  can  be  used  to  compensate  for  the 
large  yawing  moments  generated  by  asymmetric  thrust  in  an  engine-out  situation. 

Servo  valve  (in  the  737  main  rudder  PCU):  A  valve  used  to  control  rudder  direction  and 
rate  of  movement.  The  valve  comprises  a  primary  slide  that  moves  within  a  secondary 
slide  that,  in  turn,  moves  within  the  servo  valve  housing.  These  slides  direct  hydraulic 
fluid  through  passages  to  cause  rudder  movement. 

Servo  valve  housing  (in  the  737  main  rudder  PCU):  A  cylinder-shaped  assembly  that 
contains  hydraulic  fluid  passages  and  interacts  with  the  servo  valve  secondary  slide. 

Servo  valve  primary  slide  (in  the  737  main  rudder  PCU):  A  cylindrical  piston  that 
moves  within  the  servo  valve  secondary  slide.  It  is  moved  by  an  internal  primary 
summing  lever,  which  translates  inputs  from  the  yaw  damper  and/or  the  external  input 
crank  (which  moves  when  a  pilot  applies  pressure  to  a  rudder  pedal)  into  axial 
movement  of  the  primary  slide. 

Servo  valve  secondary  slide  (in  the  737  main  rudder  PCU):  A  cylindrical  “sleeve”  that 
encloses  the  servo  valve  primary  slide.  It  is  moved  by  the  internal  secondary  summing 
lever,  which  translates  inputs  from  the  yaw  damper  and/or  the  external  input  crank 
(which  moves  when  a  pilot  applies  pressure  to  a  rudder  pedal)  into  axial  movement  of 
the  secondary  slide. 

Sideload:  The  effect  of  lateral  acceleration,  typically  the  result  of  sideslip  or  yaw 
acceleration. 
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Sideslip:  The  lateral  angle  between  the  longitudinal  axis  of  the  airplane  and  the  direction 
of  motion  (flightpath  or  relative  wind).  It  is  normally  produced  by  rudder  forces, 
yawing  motion  resulting  from  asymmetrical  thrust,  or  lateral  gusts. 

Silting:  The  accumulation  of  particles  of  contaminants  in  hydraulic  fluid  in  a  hydraulic 
component.  The  particles  are  smaller  than  the  filter  on  the  inlet  side  of  the  component 
and  tend  to  settle  at  various  edges  and  comers  of  valves  and  stay  there  unless  washed 
away  by  higher  flow  rates. 

Slat:  An  aerodynamic  surface  located  on  an  airplane  wing’s  leading  edge  that  may  be 
extended  to  provide  additional  lift. 

Spoiler:  A  device  located  on  an  airplane  wing’s  upper  surface  that  may  be  activated  to 
provide  increased  drag  and  decreased  lift. 

Standby  hydraulic  system:  An  independent  hydraulic  system  that  contains  its  own 
electric  pump  that,  when  activated,  powers  the  standby  mdder  system.  It  also  provides 
an  alternate  source  of  power  for  both  thrust  reversers  and  extends  the  leading  edge 
flaps  and  slats  in  the  “ALTERNATE  FLAPS”  mode. 

Standby  rudder  system:  A  system  that  provides  backup  control  of  the  rudder  when 
activated  or  in  the  event  of  a  hydraulic  system  failure.  It  is  powered  by  the  standby 
hydraulic  system  and  is  unpressurized  during  normal  operations. 

Summing  lever  (in  the  737  main  rudder  PCU):  One  of  two  internal  levers  (primary  or 
secondary)  within  the  main  rudder  PCU  that  applies  force  to  move  the  servo  valve’s 
primary  or  secondary  slides,  respectively.  Also,  an  external  lever  that  transmits  mdder 
pedal  and  trim  input  to  the  PCU’s  external  input  crank. 

Vertical  motion  simulator:  A  simulator  at  the  National  Aeronautics  and  Space 
Administration’s  Ames  Research  Center  that  is  the  world's  largest  motion  simulator 
(with  60  feet  of  vertical  travel).  It  can  be  adapted  to  represent  a  large  number  of 
airplanes,  helicopters,  and  spacecraft.  The  large  motion  of  this  simulator  provides  a 
more  accurate  representation  of  flight  dynamics  and  accelerations  than  can  be 
experienced  in  the  Boeing  M-CAB  or  a  normal  pilot  training  simulator. 

Wake  vortex:  A  counterrotating  airmass  trailing  from  an  airplane’s  wing  tips.  The 
strength  of  the  vortex  is  governed  by  the  weight,  speed,  and  shape  of  the  wing  of  the 
generating  aircraft;  the  greatest  strength  occurs  when  the  wings  of  the  generating 
aircraft  are  producing  the  most  lift,  that  is,  when  the  aircraft  is  heavy,  in  a  clean 
configuration,  and  at  a  slow  airspeed.  (Also  known  as  wake  turbulence.) 

Yaw:  Rotation  of  an  airplane  about  its  vertical  axis. 

Yaw  control:  The  function  that  is  normally  performed  by  the  mdder  by  pilot  input  or  yaw 
damper  input.  (Also  known  as  directional  control.) 

Yaw  damper  (in  the  737  main  rudder  PCU):  A  system,  composed  of  the  yaw  damper 
control  switch  and  a  yaw  damper  coupler,  that  automatically  corrects  for  yaw  motion. 
The  737  yaw  damper  coupler  includes  a  rate  gyro  that  senses  aircraft  motion  about  the 
yaw  axis  and  converts  the  motion  to  an  electrical  signal  that  is  sent  to  the  main  mdder 
PCU,  which  applies  the  mdder  to  stop  the  yaw. 
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1 .  Factual  Information 


1.1  History  of  Flight 

On  September  8,  1994,  about  1903:23  eastern  daylight  time,*  USAir  (now  US 
Airways)^  flight  427,  a  Boeing  737-3B7  (737-300),  N513AU,  crashed  while  maneuvering 
to  land  at  Pittsburgh  International  Airport  (PIT),  Pittsburgh,  Pennsylvania.  Flight  427  was 
operating  under  the  provisions  of  14  Code  of  Federal  Regulations  (CFR)  Part  121  as  a 
scheduled  domestic  passenger  flight  from  Chicago-O'Hare  International  Airport  (ORD), 
Chicago,  Illinois,  to  Pittsburgh.  The  flight  departed  ORD  about  1810,  with  2  pilots, 
3  flight  attendants,  and  127  passengers  on  board.  (Table  1,  in  section  1.2,  shows  an  injury 
chart.)  The  airplane  entered  an  uncontrolled  descent  and  impacted  terrain  near  Aliquippa, 
Pennsylvania.  All  132  people  on  board  were  killed,  and  the  airplane  was  destroyed  by 
impact  forces  and  fire.  Visual  meteorological  conditions  prevailed  for  the  flight,  which 
operated  on  an  instrument  flight  rules  (IFR)  flight  plan. 

The  accident  occurred  on  the  third  day  of  a  3-day  trip  sequence  for  the  flight  crew. 
The  pilots  reported  for  duty  on  the  day  of  the  accident  about  1215  in  Jacksonville,  Florida, 
and  departed  Jacksonville  International  Airport  in  the  accident  airplane,  designated  as 
USAir  flight  1181,  to  Charlotte,  North  Carolina,  about  1310.  Flight  1181  arrived  at 
Charlotte-Douglas  International  Airport  about  1421.  The  next  trip  segment,  also 
designated  as  flight  1181,  departed  Charlotte  for  ORD  about  1521.  The  airplane  arrived  at 
the  destination  airport  about  1707. 

At  ORD,  the  accident  airplane  was  designated  as  USAir  flight  427  with  an 
intended  destination  of  Pittsburgh  and  the  same  flight  crew  performing  flight  duties.  Flight 
427  departed  the  gate  at  ORD  about  1802,  and  became  airborne  about  1810.  The  flight 
plan  filed  for  flight  427  indicated  an  estimated  en  route  time  of  55  minutes.  Review  of  air 
traffic  control  (ATC)  and  cockpit  voice  recorder  (CVR)  information^  indicated  that  the 
captain  was  performing  the  radio  communications  and  other  pilot-not-flying  (PNF)  duties 
and  that  the  first  officer  was  performing  the  pilot-flying  (PF)  duties  with  the  auto-flight 
system  (AFS)  engaged.'* 

The  CVR  indicated  that,  about  1845:31,  ATC  personnel  at  Cleveland  Air  Route 
Traffic  Control  Center  cleared  USAir  flight  427  to  descend  from  its  en  route  cruise 
altitude  of  flight  level  (FL)  290  to  FL  240.^  The  captain  responded,  “out  of  two  nine  oh  for 


‘  Unless  otherwise  indicated,  all  times  are  eastern  daylight  time,  based  on  a  24-hour  clock. 

^  For  consistency,  US  Airways  is  referred  to  as  USAir. 

^  A  complete  transcript  of  the  CVR  is  included  in  appendix  B  of  this  report. 

*  For  additional  information  regarding  the  AFS,  see  section  1. 6.3.1. 

^  FL  290  is  29,000  feet  mean  sea  level  (msl),  based  on  an  altimeter  setting  of  29.92  inches  of  mercury 
(Hg).  Likewise,  FL  240  is  24,000  feet  msl. 
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two  four  oh....”  As  the  airplane  neared  its  destination  (about  1850:56),  Cleveland  Center 
controllers  advised  the  pilots  of  USAir  flight  427  to  “cross  CUTTA  [intersection]  at  and 
maintain  one  zero  thousand....”  The  flight  crew  acknowledged  the  descent  clearance,  and 
the  CVR  recorded  PIT  automatic  terminal  information  service  information  Yankee 
beginning  about  1851:22. 

About  1853:15,  the  CVR  recorded  the  cockpit  door  being  opened  and  closed. 
About  1853:26,  a  flight  attendant  inquired  about  connecting  flight  and  gate  information 
and  asked  if  the  pilots  wanted  anything  to  drink.  About  1854:02,  the  flight  attendant  exited 
the  cockpit.  About  1854:27,  Cleveland  Center  reiterated  the  instructions  to  cross  CUTTA 
intersection  at  10,000  feet  mean  sea  level  (msl)  and  instructed  the  pilots  to  reduce  the 
airspeed  to  250  knots.  According  to  ATC  and  radar  information,  at  that  time.  Delta  Air 
Lines  flight  1083,  a  Boeing  727  that  had  been  sequenced  to  precede  USAir  flight  427  on 
the  approach  to  PIT  from  the  northwest,  was  in  level  flight  at  10,000  feet  msl  with  an 
assigned  airspeed  of  210  knots  and  an  assigned  heading  of  160°.  Delta  flight  1083  was  in 
communication  with  Pittsburgh  terminal  radar  approach  control  (PIT  TRACON) 
personnel.^ 

About  1856:16,  Cleveland  Center  stated,  “USAir  [427]  reduce  speed  to  two  one 
zero  [210  knots]  that’s  at  the  request  of  [PIT]  approach....”  About  11  seconds  later,  the 
Cleveland  Center  controller  told  the  pilots  of  USAir  flight  427  that  they  did  not  have  to 
make  the  previously  issued  crossing  restriction  (cross  CUTTA  at  10,000  feet  msl),  just 
uh,  speed  first... pd  [pilot’s  discretion]  to  ten....”  About  1856:32,  Cleveland  Center  told 
the  pilots  to  “contact  PIT  approach  (on  frequency  121.25  Hertz  [Hz]).”  The  captain 
acknowledged  the  instructions  about  1856:36  and  advised  PIT  TRACON  about  1856:52 
that  he  was  “descending  to  ten  [thousand  feet  msl].” 

About  1857:07,  the  CVR  recorded  the  flight  attendant  returning  to  the  cockpit  and 
delivering  juice  drinks  to  the  pilots.  About  1857:23,  PIT  TRACON  responded  to  the  initial 
contact  from  the  pilots  of  USAir  flight  427.  The  controllers  instructed  the  pilots  to  turn 
right  to  a  heading  of  160°,  advised  them  that  they  would  receive  radar  vectors  to  the  final 
approach  course  for  runway  28  right  (28R)  at  PIT,  and  instructed  them  to  reduce  airspeed 
to  210  knots.  About  1858:03,  PIT  TRACON  instructed  the  pilots  of  Delta  flight  1083  to 
descend  to  and  maintain  an  altitude  of  6,000  feet  msl.  About  1858:24,  the  accident 
airplane’s  CVR  recorded  the  sound  of  an  aural  tone  similar  to  an  altitude  alert  and  the 
flight  attendant  stated,  “OK,  back  to  work.”  Flight  data  recorder  (FDR)  information 
indicated  that  the  airplane  was  at  10,818  feet  msl  at  that  time.  About  1858:29,  the  CVR 
recorded  the  sound  of  the  cockpit  door  opening  and  closing. 


*  CUTTA  intersection  is  located  about  30  nautical  miles  (nm)  northwest  of  PIT  and  is  a  northwest 
arrival  fix  for  traffic  landing  at  PIT. 

Radar  data  show  that,  at  their  closest  point  (about  1902:39),  Delta  flight  1083  and  USAir  flight  427 
were  4.1  nm  apart  at  6,000  feet  msl.  For  additional  information  regarding  radar  data  for  airplanes  in  the 
vicinity  of  the  accident  site,  see  section  1.16.2. 

^  For  more  information  about  the  data  recorded  by  the  FDR,  see  sections  1.11.2  and  1.16.6.1. 
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About  1858:33,  PIT  TRACON  controllers  instructed  USAir  flight  427  to  descend 
and  maintain  an  altitude  of  6,000  feet  msl.  The  pilots  acknowledged  the  descent 
instructions  and,  about  1859:04,  started  to  aecomplish  the  Preliminary  Landing  cheeklist 
(altimeters/flight  instruments,  landing  data,  shoulder  harnesses,  and  approach  briefing). 
The  pilots  conducted  an  approach  briefing  about  1859:28. 

According  to  ATC  transcripts,  about  1900:06,  PIT  TRACON  instructed  Delta 
flight  1083  to  turn  left  to  a  heading  of  130°  and  reduce  airspeed  to  190  knots.  About 
1900:14,  the  approaeh  controllers  assigned  USAir  flight  427  a  heading  of  140°  and  an 
airspeed  of  190  knots,  and  the  flight  crew  acknowledged  the  instructions.  About  1900:24, 
the  CVR  recorded  a  sound  similar  to  the  flap  handle  being  moved.’  About  1900:43,  the 
first  officer  began  a  routine  public  address  (PA)  announcement,'’  thanking  the  passengers 
for  traveling  with  USAir  and  asking  the  flight  attendants  to  prepare  the  cabin  for  arrival. 
At  1901:06,  the  CVR  recorded  a  chime  similar  to  the  seatbelt  chime. 

The  CVR  indicated  that,  while  the  first  officer  was  making  the  PA  announcement 
(about  1900:44),  PIT  TRACON  instrueted  Delta  flight  1083  to  turn  left  to  a  heading  of 
100°.  Also  during  the  first  officer’s  PA  announcement  (about  1901:02),  the  captain  of 
USAir  flight  427  asked  the  eontrollers  “did  you  say  two  eight  left  for  USAir  four  twenty 
seven?”  About  1901:06,  the  PIT  TRACON  controller  responded  “...USAir  [427]  it  will  be 
two  eight  right.”  About  1901:16,  the  approach  controller  advised  Delta  flight  1083  to 
contact  approach  control  on  a  different  frequeney." 

According  to  the  CVR  and  ATC  transcripts,  about  1902:22  PIT  TRACON  stated 
“USAir  427,  turn  left  [to]  heading  one  zero  zero.  Traffic  will  be  [at  your]  one  to  two 
o’clock  [position,  and]  six  miles,  northbound,  [a]  Jetstream  climbing  out  of  thirty-three 
[hundred  feet  msl]  for  five  thousand  [feet  msl].”'^  The  pilots  of  USAir  flight  427 
acknowledged  the  approach  controller’s  transmission  at  1902:32  and  stated,  “We’re 
looking  for  the  traffic  [and]  turning  to  one  zero  zero,  USAir  427.” 


’  According  to  USAir  personnel,  the  standard  configuration  for  a  737-300  airplane  operating  at  an 
airspeed  of  190  knots  during  an  approach  to  land  would  be  flaps  1,  which  provides  for  partial  extension  of 
the  wing  leading  edge  slats  and  full  extension  of  the  Krueger  (leading  edge)  flaps  and  1°  of  extension  of  the 
wing  trailing  edge  flaps.  During  postaccident  examination,  the  accident  airplane’s  flaps  were  found  in  the 
flaps  1  position  (see  section  1.12). 

FDR  data  indicated  that,  when  the  first  officer  started  the  PA  announcement,  the  airplane  was 
descending  through  7,800  feet  msl. 

'*  Review  of  the  ATC  transcripts  indicated  that  USAir  flight  427  and  Delta  flight  1083  were  using  a 
common  Pittsburgh  approach  control  frequency  for  approximately  4  minutes  40  seconds.  When  he  was 
interviewed  after  the  accident,  the  captain  of  Delta  flight  1083  stated  that  he  did  not  recall  hearing  USAir 
flight  427  on  the  frequency.  He  described  the  flight  conditions  as  “good  weather,  with  no  turbulence  or  bird 
activity.”  He  further  stated  that  the  horizon  was  clearly  visible  and  that  visibility  was  not  restricted. 

This  traffic  was  an  Atlantic  Coast  Airlines  Jetstream  31,  operating  as  flight  6425  and  departing  the 
Pittsburgh  area  on  a  360°  heading.  Although  ATC  issued  a  traffic  advisory  to  Atlantic  Coast  flight  6425 
regarding  “traffic  at  11  o’clock”  (USAir  flight  427),  the  captain  and  first  officer  of  the  Jetstream  stated  that 
they  did  not  see  flight  427.  The  captain  of  Atlantic  Coast  flight  6425  recalled  seeing  traffic  at  his  12:30  to 
1  o'clock  position,  which  he  believed  to  be  a  727.  This  position  and  type  of  airplane  was  consistent  with  that 
of  Delta  flight  1083. 
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FDR  data  indicated  that,  about  1902:53,  USAir  flight  427  was  rolling  out  of  the 
left  bank  (moving  through  T  of  left  bank  toward  a  wings-level  attitude)  as  it  approached 
the  ATC-assigned  heading  of  100°  and  was  maintaining  the  ATC-assigned  airspeed  (190 
knots)  and  altitude  (6,000  feet  msl).  According  to  the  CVR  transcript,  about  1902:54  the 
first  officer  stated,  “oh,  ya,  I  see  zuh  Jetstream.”’^  As  the  first  officer  finished  this 
statement  (about  1902:57),  the  CVR  recorded  a  sound  similar  to  three  thumps  m 
1  second,''*  the  captain  stating  “sheeez”  (at  1902:57.5),  and  the  first  officer  stating  zuh 
(at  1902:57.6).'^  Between  about  1902:57  and  about  1902:58,  FDR  data  indicated  that 
USAir  flight  427’s  airspeed  fluctuated  from  about  190  knots  to  about  193  knots  and  then 
decreased  to  about  191  knots  for  the  next  4  seconds.  Between  about  1902:57  and  about 
1902:59,  FDR  data  indicated  that  the  airplane’s  left  bank  steepened  from  slightly  less  than 
8°  to  slightly  more  than  20°.  Figure  1  shows  a  plot  of  the  FDR  data  during  the  last  30 
seconds  of  the  flight,  along  with  CVR  comments  and  sounds.'^  About  1902:58,  the  CVR 
recorded  an  additional  thump,  two  “clickety  click”  sounds,  the  sound  of  the  engine’s  noise 
getting  louder,'"'  and  the  sound  of  the  captain  inhaling  and  exhaling  quickly  one  time.  Also 
about  1902:58,  the  FDR  recorded  a  brief  forward  movement  of  the  control  column. 

About  1902:59,  the  left  roll  was  arrested,  and  the  airplane  began  to  briefly  roll 
right  toward  a  wings-level  attitude;  FDR  data  show  that,  between  about  1902.59  and  about 
1903,  the  airplane’s  left  bank  had  decreased  to  about  15°).  Also  about  1902:59,  the 
airplane’s  heading  data,  which  had  been  moving  left  steadily  toward  the  ATC-assigned 
heading  of  100°,  began  to  move  left  at  a  more  rapid  rate,  passing  through  the  100° 
heading.  At  1902:59.4,  the  CVR  recorded  the  captain  stating  “whoa”  and,  at  1902:59.7, 
the  sound  of  the  first  officer  grunting  softly.  By  just  after  1903:00,  the  airplane  had  begun 
to  roll  rapidly  back  to  the  left  again;  its  airspeed  remained  about  191  knots.  FDR  heading 
data  indicated  that,  by  1903:01,  the  airplane’s  heading  had  moved  left  through  about  089° 
and  continued  to  move  left  at  a  rate  of  at  least  5°  per  second  until  the  stickshaker  activated 
about  1903:08.  Between  about  1903:01  and  about  1903:04,  the  CVR  recorded  the  sound 
of  the  first  officer  grunting  loudly  and  making  brief  exclamatory  remarks'*  while  the 
airplane  continued  to  roll  left,  with  several  fluctuations  in  the  roll  rate. 


The  737  has  three  windows  on  each  side  of  the  cockpit.  These  windows  consisted  of  a  forward-facing 
windscreen,  a  window  located  at  the  pilot’s  side,  and  a  middle  window  (located  between  the  forward  and 
side  windows).  Postaccident  examination  of  radar  data  and  simulations  revealed  that  the  Jetstream  tramc 
would  have  been  visible  at  that  time  through  the  lower  part  of  the  middle  window  on  the  first  officer  s  side 
of  the  airplane. 

These  sounds  (and  other  sounds  that  occurred  during  the  upset  sequence)  are  discussed  in  detail  in 
section  1.16.7. 

In  this  report,  CVR  comments  and  noises,  which  are  recorded  continuously  and  can  be  accurately 
transcribed  to  the  nearest  one-tenth  of  a  second,  are  depicted  to  the  nearest  one-tenth  of  a  second  during 
descriptions  of  the  upset  sequence  portion  of  the  flight  for  detail  and  clarity.  FDR  data  are  sampled  at 
specific  times  and  intervals,  which  vary  depending  on  the  parameter;  therefore,  FDR  times  in  this  report  are 
referenced  to  the  nearest  full  second. 

“  The  CVR  time  equals  the  FDR  time  in  seconds  plus  1900:43  (local  time). 

The  sound  of  the  engine  noise  getting  louder  was  determined  from  a  spectrum  analysis  of  sounds 
recorded  on  the  CVR  (see  section  1.16.7.3).  This  sound  cannot  be  discerned  simply  by  listening  to  the  CVR 
and  is  therefore  not  described  on  the  CVR  transcript. 

The  pilots’  speech,  breathing,  and  other  sounds  are  discussed  in  greater  detail  in  section  1.16.8. 
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Figure  1.  FDR  data  during  the  final  30  seconds  of  USAir  flight  427 
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FDR  information  revealed  that,  just  before  1903:03,  the  airplane’s  left  bank  angle 
had  increased  to  about  43°,  the  airplane  had  begun  to  descend  from  its  assigned  altitude  of 
6,000  feet  msl,  the  control  column  had  started  to  move  aft,  and  the  airspeed  started  to 
decrease  below  190  knots.  Less  than  1  second  later,  the  CVR  recorded  the  sound  of  the 
autopilot  disconnect  horn.  During  the  next  5  seconds,  the  FDR  recorded  increasing  left 
roll,  aft  control  column,  decreasing  altitude,  and  a  decreasing  airspeed  to  about  186  knots. 

Also  between  1903:02.7  and  1903.07.7,  the  CVR  recorded  several  brief  remarks 
on  the  flight  crew  channels.  At  1903:07.5,  the  CVR  recorded  a  sound  of  increasing 
amplitude  similar  to  onset  of  stall  buffet  and  the  captain  stating  “what  the  hell  is  this?” 
The  CVR  transcript  indicated  that,  at  1903:08.1,  a  vibrating  sound  similar  to  aircraft 
stickshaker  started  and  continued  until  the  end  of  the  recording.  At  1903:08.3,  an  aural 
tone  similar  to  an  altitude  alert  sounded,  and  1  second  later,  the  traffic  alert  and  collision 
avoidance  system  sounded  “traffic  traffic.”^’ 

According  to  the  ATC  transcript,  a  radio  transmission  from  USAir  flight  427  about 
1903:10  stated,  “Oh  (unintelligible)  Oh  [expletive].”^®  The  approach  controller  reported 
that,  at  that  time,  flight  427’s  altitude  readout  on  the  radar  screen  indicated  5,300  feet. 
About  1903:14,  the  controller  stated  “USAir  427  maintain  6,000,  over.”  About  1903:15, 
the  CVR  transcript  indicated  that  the  captain  made  a  radio  transmission,  stating  “four 
twenty  seven  emergency.”  Between  1903:18.1  and  1903:19.7,  the  CVR  recorded  the 
captain  stating  “pull... pull... pull.”  From  about  1903:09  to  about  1903:22,  the  first 
officer’s  radio  microphone  was  activated  and  deactivated  repeatedly,  so  the  ATC  tapes 
recorded  exclamations  and  other  sounds  from  the  accident  airplane.  During  postaccident 
interviews,  air  traffic  controllers  who  were  in  the  tower  cab  when  the  accident  occurred 
reported  that  they  observed  dense  smoke  rising  to  the  northwest  of  the  airport  shortly  after 
USAir  flight  427’s  final  transmission.  The  CVR  stopped  recording  at  1903:22.8. 

About  1903:23,  the  airplane  impacted  hilly,  wooded  terrain  near  Aliquippa, 
Pennsylvania,  approximately  6  miles  northwest  of  PIT.  The  location  of  the  accident  was 
40°  36  minutes,  14.14  seconds  north  latitude,  80°  18  minutes,  36.95  seconds  west 
longitude  at  an  elevation  of  about  930  feet  msl.  The  accident  occurred  during  daylight 
hours. 


The  traffic  alert  and  collision  avoidance  system  is  an  airborne  system  based  on  radar  beacon  signals 
that  operate  independent  of  ground-based  equipment.  Although  it  was  not  possible  to  positively  determine 
what  triggered  the  system’s  alert,  radar  information  indicated  that,  during  the  accident  sequence,  USAir 
flight  427  was  within  about  3  miles  of  Atlantic  Coast  flight  6425  when  the  accident  airplane  descended 
through  the  Atlantic  Coast  flight’s  altitude. 

^  The  CVR  transcript  also  indicated  that  the  pilots  of  USAir  flight  427  made  a  radio  transmission  to 
ATC  about  1903:10  and  that  the  captain’s  cockpit  microphone  recorded  the  statement,  “Oh  God... Oh  God.” 
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1 .2  Injuries  to  Persons 

Table  1.  Injury  chart. 


Injuries 

Crew 

Passengers 

others 

Total 

Fatal 

5 

127 

0 

132 

Serious 

0 

0 

0 

0 

Minor/None 

0 

0 

0 

0 

total 

5 

127 

0 

132 

1 .3  Damage  to  Aircraft 

The  airplane  was  destroyed  by  ground  impact  and  postcrash  fire.  According  to 
insurance  company  records,  the  airplane  was  valued  at  $30  million. 

1 .4  Other  Damage 

No  structures  on  the  ground  were  damaged.  Trees  and  vegetation  near  the  accident 
site  were  destroyed  or  damaged  by  the  impact,  fuel  blight,  and  postcrash  fire  and  during 
wreckage  removal. 

1.5  Personnel  information 

The  flight  crew  consisted  of  the  captain  and  the  first  officer.  Three  flight  attendants 
were  also  on  duty  aboard  the  airplane.  The  3-day  trip  sequence  during  which  the  accident 
occurred  was  the  first  time  the  captain  and  the  first  officer  had  flown  together. 

Both  pilots  were  off  duty  on  Monday,  September  5,  1994  (Labor  Day  holiday). 
According  to  their  wives,  both  pilots  spent  their  off-duty  time  relaxing  with  family  and 
friends  and  received  a  normal  amount  of  sleep^'  before  they  reported  for  flight  duty. 

The  pilots  reported  for  duty  in  Philadelphia,  Pennsylvania,  on  Tuesday, 
September  6,  about  1615  for  the  3-day  trip  sequence.  On  the  first  day,  the  pilots  flew  to 
Indianapolis,  Indiana,  returned  to  Philadelphia,  and  then  continued  to  Toronto,  Ontario, 
Canada.  They  arrived  in  Toronto  about  2310,  completed  their  flight-related  duties  about 
2327,  and  remained  in  Toronto  overnight.  According  to  the  flight  logs,  the  pilots’  duty 
time  for  the  first  day  of  their  trip  sequence  was  about  7  hours  12  minutes,  including  about 
4  hours  56  minutes  of  flight  time.  At  Toronto,  the  pilots  had  a  scheduled  layover  of  about 
14  hours  30  minutes. 


The  captain’s  wife  reported  that  he  normally  slept  about  714  hours  each  night  when  he  was  not 
working.  She  indicated  that,  on  September  4  and  5,  the  captain  went  to  bed  between  2300  and  2400  and 
awoke  between  0700  and  0800  the  following  mornings.  The  first  officer’s  wife  reported  that  he  normally 
slept  about  8  hours  each  night  when  he  was  not  working.  She  indicated  that,  on  September  4,  the  first  officer 
went  to  bed  about  2200  and  awoke  about  0630  the  next  morning;  on  September  5,  he  went  to  bed  about  2200 
and  awoke  earlier  than  usual  (about  0500)  the  next  morning  to  begin  the  commute  from  his  home  near 
Houston,  Texas,  to  Philadelphia,  Pennsylvania,  to  report  for  duty  later  that  day. 
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On  the  second  day  of  the  trip  sequence  (Wednesday,  September  7),  the  pilots’  duty 
period  began  about  1400  at  Toronto.  They  flew  to  Philadelphia,  then  Cleveland,  Ohio, 
then  Charlotte,  North  Carolina;  and  then  Jacksonville,  Florida.  They  arrived  in 
Jacksonville  about  2254,  completed  their  flight-related  duties  about  2321,  and  remained  in 
Jacksonville  overnight.  According  to  the  flight  logs,  the  pilots’  duty  time  for  the  second 
day  of  their  trip  sequence  was  about  9  hours  21  minutes,  including  about  5  hours 
16  minutes  of  flight  time.  At  Jacksonville,  the  pilots  had  a  scheduled  layover  of  nearly 
13  hours  before  reporting  for  duty  about  1215  on  Thursday,  September  8. 

1.5.1  The  Captain 

The  captain,  age  45,  was  hired  by  USAir  on  February  4,  1981,  while  on  furlough 
from  Braniff  Airways.  He  held  airline  transport  pilot  (ATP)  certificate  No.  1954135  with  a 
multiengine  land  airplane  rating  and  a  type  rating  in  the  737.  Additionally,  he  held  a  flight 
engineer  certificate  and  a  commercial  pilot  certificate  with  single-engine  land, 
multiengine  land,  and  instrument  ratings.  The  captain’s  most  recent  first-class  Federal 
Aviation  Administration  (FAA)  airman  medical  certificate  was  issued  on  July  9,  1994, 
with  no  restrictions  or  limitations. 

The  captain’s  initial  flight  experience  was  in  general  aviation,  and  he  obtained  a 
private  pilot  certificate  in  August  1969.  He  subsequently  entered  the  U.S.  Air  National 
Guard  and  successfully  completed  the  U.S.  Air  Force  (USAF)  pilot  training  program^^  in 
December  1973.  The  Safety  Board  was  unable  to  review  the  captain’s  USAF  training  and 
flight  records  from  before  September  3,  1975,  because,  according  to  a  USAF 
representative,  flight  records  dated  before  then  (including  the  captain’s  initial  training 
records)  had  been  destroyed.  The  captain’s  available  military  flight  records  indicated  that, 
between  September  3,  1975,  and  March  15,  1979,  he  accumulated  about  894  hours  of 
military  flight  time,  including  227  hours  of  training  and  667  hours  in  the  Cessna  0-2 
observation  airplane.^^ 

The  captain  obtained  a  commercial  pilot  certificate  in  June  1974,  a  flight  engineer 
certificate  on  July  28,  1976,  and  an  ATP  certificate  with  a  type  rating  in  the  737  on 
August  25,  1988.  He  was  hired  by  Braniff  Airways  on  October  17,  1977.  His  initial 
assignment  with  Braniff  was  as  second  officer  on  a  Douglas  Aircraft  Company  DC-8.  On 
December  1,  1980,  the  captain  was  furloughed  by  Braniff.  Two  months  later,  the  captain 
was  hired  by  USAir.  As  he  neared  the  end  of  the  required  1-year  probation  period  at 
USAir,  the  captain  submitted  a  letter  of  resignation  to  Braniff  on  January  25, 1982,  with  an 
effective  date  of  February  4,  1982.  Braniff  personnel  records  indicated  that  the  captain 
would  be  considered  for  rehire. 

The  captain’s  first  assignment  with  USAir  was  as  a  flight  engineer  on  the  727.  He 
was  upgraded  to  first  officer  on  the  British  Aerospace  Corporation  (BAC)  111  in 


The  USAF  provides  pilot  training  for  Air  National  Guard  personnel. 

The  Cessna  0-2  is  the  military  version  of  the  Cessna  337,  an  in-line  thrust,  twin  reciprocating  engine- 
powered  airplane.  The  Cessna  0-2  is  used  in  forward  air  control  observations  and  is  not  approved  for 
aerobatic  maneuvers. 
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November  1982.  He  transitioned  to  the  737  in  September  1987  as  a  first  officer  and  was 
upgraded  to  captain  on  the  737  on  August  25,  1988.  According  to  US  Air  records,  at  the 
time  of  the  accident,  the  captain  had  flown  approximately  12,000  flight  hours,  including 
3,269  hours  as  a  737  captain.  He  also  had  795  flight  hours  as  a  737  first  officer. 

USAir  records  indicated  that  the  captain  was  on  extended  sick  leave  from 
January  25  to  April  28,  1994,  because  of  back  surgery. When  he  returned  to  flight  duty, 
the  captain  underwent  737  requalification  and  crew  resource  management  (CRM) 
training,  which  he  completed  on  April  29, 1994.  The  captain’s  most  recent  line  check  was 
completed  on  May  6,  1994,  and  his  most  recent  line-oriented  flight  training  (LOFT)  was 
completed  on  July  19, 1994. 

A  review  of  USAir’s  training  records  indicated  that  the  captain  performed 
satisfactorily  in  initial,  recurrent,  CRM,  and  LOFT  training  and  line  and  proficiency 
checks  in  all  airplanes  and  all  positions.^^  Additionally,  a  review  of  the  captain’s  USAir 
personnel  records,  FAA  airman  certification  records,  and  FAA  accident/incident  and 
violation  histories  revealed  nothing  noteworthy.  During  postaccident  interviews,  several 
check  airmen,  instructors,  and  first  officers  who  were  acquainted  with  the  captain  and  his 
piloting  abilities  indicated  that  the  captain  was  meticulous,  very  proficient,  very 
professional,  and  attentive  to  detail  and  that  he  flew  “by  the  book.’’  They  also  reported  that 
the  captain  was  well  liked  and  exhibited  excellent  CRM  skills. 

According  to  his  wife,  the  captain  did  not  complain  of  back  pain  after  he  returned 
to  flight  duty.  She  stated  that  he  took  no  medication,  other  than  allergy  injections,^^  and 
drank  alcohol  rarely.  She  considered  his  overall  health  to  be  “very  good.”  A  review  of  the 
USAir-sponsored  insurance  company  medical  records  revealed  that,  during  the  5  years 
before  the  accident,  the  medical  claims  submitted  by  the  captain  indicated  no  significant 
illnesses  or  hospitalizations  except  for  the  back  surgery  shown  in  company  records. 

The  Safety  Board’s  review  of  the  captain’s  available  flight  records  (civilian  and 
post-1975  military  records)  revealed  no  documentation  of  aerobatic  flight  experience. 


The  captain  underwent  back  surgery  in  March  1994  to  remove  a  ruptured  disk. 

Although  the  captain’s  training  records  indicated  that  he  satisfactorily  completed  all  training  and  line 
and  proficiency  checks  in  all  airplanes  and  all  positions,  the  training  record  from  his  September  1987 
transition  from  BAC-111  first  officer  to  737  first  officer  contained  the  instructor’s  remark,  “1  would  place  at 
end  of  training,  [the  captain]  in  [the]  lower  10  percent.”  During  postaccident  interviews,  the  instructor  stated 
that  he  did  not  recall  the  circumstances  that  prompted  him  to  make  this  remark.  He  further  stated  that,  if  the 
captain  had  not  satisfied  all  the  requirements,  he  would  have  graded  the  captain’s  performance 
unsatisfactory. 

During  postaccident  interviews,  the  captain’s  allergist  stated  that  the  captain  exhibited  mild  allergy 
symptoms,  such  as  sneezing,  runny  nose,  and  postnasal  drip,  which  responded  well  to  allergy  injections.  The 
allergist  reported  that  the  captain  was  current  with  his  allergy  injections,  having  received  the  most  recent  one 
in  August  1994. 

The  Safety  Board  is  aware  that  the  USAF’s  initial  pilot  training  program  included  aerobatic  training 
in  the  T-37  and  T-38  jet  trainers.  (No  records  were  available  of  the  captain’s  initial  training  in  the  Air  Force.) 
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1 .5.2  The  First  Officer 

The  first  officer,  age  38,  was  hired  by  Piedmont  Airlines  in  February  1987  and 
became  a  USAir  employee  after  USAir  acquired  Piedmont  Airlines  in  June  1989.  He  held 
ATP  certificate  No.  2238867  with  single-engine  and  multiengine  land  airplane  ratings. 
Additionally,  he  held  a  commercial  pilot  certificate  with  single-engine  land,  multiengine 
land,  and  instrument  ratings.  The  first  officer’s  most  recent  FAA  first-class  airman 
medical  certificate  was  issued  on  July  7, 1994,  with  no  restrictions  or  limitations. 

The  first  officer’s  initial  flight  experience  was  in  general  aviation.  He  was  issued  a 
private  pilot  certificate  in  May  1973,  multiengine  and  instrument  ratings  in  December 
1980,  a  commercial  pilot  certificate  in  January  1981,  and  the  ATP  certificate  in  October 
1982. 


The  first  officer’s  initial  position  with  Piedmont  Airlines  was  as  a  first  officer  on 
the  Fokker  F.28.  He  transitioned  to  first  officer  on  the  737  on  May  1,  1989,  and  remained 
in  that  position  after  he  became  a  USAir  employee  in  June  1989.  At  the  time  of  the 
accident,  the  first  officer  had  a  total  of  9,119  flight  hours,  including  3,644  flight  hours  as  a 
737  first  officer.  His  most  recent  proficiency  check,  which  included  CRM  refresher 
training,  was  satisfactorily  completed  on  May  12,  1994. 

A  review  of  the  first  officer’s  USAir  personnel  records,  FAA  airman  certification 
records,  and  FAA  accident/incident  and  violation  histories  revealed  nothing  noteworthy. 
According  to  his  training  records,  the  first  officer  performed  satisfactorily  in  initial  and 
LOFT  training  and  line  and  proficiency  checks  in  all  airplanes  and  all  positions.  During 
postaccident  interviews,  check  airmen,  instructors,  and  captains  who  were  acquainted  with 
the  first  officer  and  his  piloting  abilities  indicated  that  the  first  officer  was  friendly,  very 
well  qualified,  and  an  outstanding  first  officer  who  exhibited  exceptional  piloting  skills. 
USAir’s  Philadelphia-based  chief  pilot  stated  that  the  first  officer  was  a  "very  dedicated, 
professional,  dependable  person."  One  captain  who  had  flown  with  the  first  officer 
described  an  in-flight  hydraulic  system  emergency  that  occurred  during  one  of  their 
flights.  He  stated  that  the  first  officer  remained  very  calm  during  the  emergency  situation. 

According  to  the  first  officer’s  wife,  he  did  not  take  medication  and  was  a 
moderate,  occasional  drinker.  She  characterized  the  first  officer  s  overall  health  as 
“excellent.”  A  review  of  the  USAir-sponsored  insurance  company  medical  records 
revealed  that  the  first  officer  had  not  made  any  medical  claims  during  the  5  years  before 
the  accident. 

Examination  of  the  first  officer’s  personal  logbooks  and  records  did  not  indicate 
any  aerobatic  flight  training  or  experience.  However,  his  flight  logbooks  indicated  that  he 
had  performed  spin  recoveries  on  three  occasions  in  1973  in  a  Piper  J-3  “Cub”  airplane 
when  he  had  total  flight  times  between  77  and  93  hours. 
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1.5.3  Flight  Attendant  Information 

The  lead,  or  “A”  position  flight  attendant  was  hired  by  Piedmont  Airlines  in  May 
1989.  He  completed  the  USAir  Merger  Module  Training  that  was  required  when  USAir 
acquired  Piedmont  Airlines  in  June  1989.  His  most  recent  recurrent  training  was 
satisfactorily  completed  on  June  14,  1994,  and  he  was  qualified  on  the  737-300.  The  “B” 
position  flight  attendant  was  hired  by  Piedmont  Airlines  in  March  1989.  She  also 
completed  the  USAir  Merger  Module  Training  in  June  1989.  Her  most  recent  recurrent 
training  was  satisfactorily  completed  on  February  2,  1994,  and  she  was  qualified  on  the 
737-300.  The  “C”  position  flight  attendant  was  hired  by  USAir  in  October  1988.  Her  most 
recent  recurrent  training  was  satisfactorily  completed  on  October  14,  1993,  and  she  was 
qualified  on  the  737-300. 

1 .6  Airplane  Information 

N513AU,  a  737-300  series  airplane  (model  737-3B7),^*  serial  number  (S/N) 
23699,  was  a  pressurized,  low-wing,  narrow-body  transport-category  airplane,  equipped 
with  two  CFM  IntemationaP’  CFM56-3B-2  engines  (operated  at  the  CFM56-3-B1  thrust 
rating).  The  No.  1  (left)  engine,  S/N  725150,  had  been  operated  about  13,880  flight  hours 
since  new,  including  3,462  flight  hours  and  2,160  flight  cycles  since  it  was  overhauled  and 
installed  on  N513AU  in  August  1993.  The  No.  2  (right)  engine,  S/N  720830,  had  been 
operated  about  16,810  flight  hours  since  new,  including  3,789  flight  hours  and  2,340  flight 
cycles  since  it  was  overhauled  and  installed  on  N513AU  in  July  1993.  At  the  time  of  the 
accident,  the  airplane  had  been  operated  about  23,846  total  hours  of  flight  time  and  14,489 
cycles.  When  the  accident  airplane  was  manufactured  and  delivered  to  USAir  in  October 
1987,  it  was  registered  as  N382AU;  USAir  re-registered  the  airplane  as  N513AU  in 
December  1987  after  the  airline  acquired  Pacific  Southwest  Airlines  (PSA). 

The  airplane  was  equipped  with  an  auxiliary  fuel  tank,  which  had  been  deactivated 
and  held  no  fuel  at  the  time  of  the  accident.^*^  The  presence  of  the  auxiliary  fuel  tank 
limited  the  cargo  capacity  of  the  aft  cargo  compartment. 

Dispatch  records  indicate  that  the  airplane  held  a  total  of  15,400  pounds  of  fuel 
when  it  left  the  gate  at  ORD  and  that  the  estimated  fuel  consumption  for  the  flight  to 
Pittsburgh  was  about  6,400  pounds.  According  to  the  USAir  dispatch  papers  for  USAir 


The  737-300  series  airplane  is  one  of  several  737  models.  Other  737  models  include  the  -100,  -200, 
-400,  -500,  -600,  -700,  -800,  and  -900.  The  737-600  through  -900  series  airplanes  are  referred  to  as  the  737 
next-generation  (NG)  airplanes. 

CFM  International  is  a  joint  venture  engine-manufacturing  company  formed  in  1974  by  General 
Electric  (now  General  Electric  Aircraft  Engines)  of  the  United  States  and  Society  National  d’Etude  et  de 
Construction  de  Moteurs  d’ Aviation  of  France. 

The  accident  airplane  was  equipped  with  a  Patrick  Aircraft  Tank  System  auxiliary  fuel  tank  system. 
This  425-gallon-capacity  auxiliary  fuel  tank  system  was  located  in  the  forward  end  of  the  aft  cargo  bay. 
According  to  USAir  maintenance  records,  the  auxiliary  fuel  tank  was  installed  in  the  accident  airplane  on 
October  17,  1987,  and  was  deactivated  in  accordance  with  the  manufacturer’s  procedures  on  January  10, 
1994. 
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flight  427,  8  passengers  were  seated  in  the  first-class  cabin,  and  119  passengers  were 
seated  in  the  coach  cabin.  According  to  USAir’s  dispatch  papers,  flight  427’s  documented 
cargo  consisted  of  10  boxes  of  magazines  weighing  1,939  pounds.  The  boxes  were  loaded 
in  the  forward  compartment  with  about  425  pounds  of  passenger  baggage,  the  aft  cargo 
compartment  was  loaded  with  1,275  pounds  of  passenger  baggage.  USAir’s  dispatch 
papers  also  indicated  that  the  airplane’s  gross  takeoff  weight  when  it  departed  ORD  was 
114,969  pounds.  The  airplane  had  a  certificated  maximum  gross  weight  of  135,500 
pounds  and  a  maximum  takeoff  weight  for  the  departure  runway  (32L)  at  ORD  of  118,700 
pounds.  On  the  basis  of  Safety  Board  calculations,  flight  427,  at  the  time  of  the  accident, 
had  an  estimated  operating  weight  of  108,600  pounds  and  a  center  of  gravity  of  19  percent 
mean  aerodynamic  chord,  which  was  within  the  allowable  weight  and  balance  envelope 
for  the  approach  and  landing  phase  of  flight. 

1.6.1  Accident  Airplane  Maintenance  Information 

1. 6.1.1  Inspections 

USAir’s  FAA-accepted  continuous  airworthiness  maintenance  program  for  its 
737s  included  six  specific  checks  to  be  accomplished  at  various  calendar  or  operating  time 
intervals.  The  maintenance  inspection  intervals  and  the  times  and  dates  that  those 
inspections  were  last  accomplished  on  the  accident  airplane  were  as  follows. 

•  Wheel/Oil  Check — Accomplished  once  every  operating  day.  Accomplished  on 
the  accident  airplane  during  transit  check  on  September  8,  1994,  about  5% 
flight  hours  before  the  accident. 

•  Transit  Check — Accomplished  every  35  flight  hours  or  7  calendar  days, 
whichever  comes  first.  Accomplished  on  the  accident  airplane  on  September  8, 
1994,  about  5%  flight  hours  before  the  accident. 

•  "A"  Check — Not  to  exceed  200  flight  hours.  Accomplished  on  the  accident 
airplane  on  August  25, 1994,  about  133  flight  hours  before  the  accident. 

•  "B"  Check — ^Not  to  exceed  1,150  flight  hours.  Accomplished  on  the  accident 
airplane  on  May  19, 1994,  about  1,008  flight  hours  before  the  accident. 

•  "C"  Check — Not  to  exceed  4,600  flight  hours.  The  C  check  is  broken  down 
into  four  segments  at  1,150-hour  intervals.  A  quarter  C  check  was  completed 
on  the  accident  airplane  on  July  20,  1994,  about  433  flight  hours  before  the 
accident. 

•  "O"  Check — ^Not  to  exceed  1 1,000  hours  or  42  months,  whichever  comes  first. 
The  initial  Q  check  is  not  required  until  20,000  hours  or  80  months,  whichever 
comes  first.  The  Q  check  is  an  approved  alternative  to  the  structural  inspection 
("D"  check).  Maintenance  endorsements  for  work  completed  during  the 
accident  airplane’s  last  Q  check  were  dated  February  3  through  5,  1993,  about 
19  months  before  the  accident. 
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A  review  of  the  accident  airplane’s  maintenance  records  from  June  2,  1994,  to  the 
accident  date  revealed  the  following  five  maintenance  carryover  items: 

•  the  left  aft  inboard  flap  assembly  was  dented, 

•  an  interim  repair  to  correct  a  soft  and  spongy  aisle  floor  section  adjacent  to  seat 
row  number  5  (about  fuselage  station  360)  was  needed, 

•  the  attach  mount  bushing  on  the  thrust  reverser  “C”  duct  for  the  right  engine 
was  worn, 

•  the  lower  left  and  right  C  duct  sliders  on  the  right  engine  were  worn  30  to  49 
percent,  and 

•  the  lower  left  and  right  C  duct  sliders  on  the  left  engine  were  worn  30  to  49 
percent. 

Examination  of  the  maintenance  work  cards  from  the  most  recent  C  and  Q  checks 
noted  several  reports  of  lavatory  fluid,  known  as  “blue  water,”  leaking  under  the  sink  and 
toilet  of  the  forward  lavatory.^*  Additionally,  the  work  cards  noted  corrosion  in  the 
forward  galley  floor  structure. 

Maintenance  records  for  the  most  recent  Q  check  indicated  that  a  thrust  reverser 
synchronizer  lock  (sync-lock)  system^^  was  installed  in  accordance  with  Boeing  Service 
Bulletin  (SB)  737-78-1053,  dated  December  17,  1992,  and  USAir  engineering 
authorization  18190.  However,  on  February  11,  1993,  Boeing  issued  Service  Letter  (SL) 
737-SL-78-26,  which  advised  all  737  operators  to  deactivate  the  sync-lock  system  (if 
installed)  because  of  “the  possibility  of  an  intermittent  condition  which  results  in  the 
inability  to  attain  reverse  thrust  when  commanded.”  A  USAir  work  card,  dated 
February  5,  1993,  stated  “accomplish... de-activation  of  T/R  [thrust  reverser]  sync  lock 
system... [according  to]  737-SL-78-26”^^  and  referenced  USAir  engineering  authorization 
18477,  “De-activation  of  Thrust  Reverser  Sync  Lock  System,”  dated  February  4,  1993. 
The  system’s  wiring  harness  remained  installed  with  its  electrical  connectors  capped  and 
secured  and  the  electric  synchronizer  locks  removed.  The  sync-lock  system  on  the 
accident  airplane  remained  deactivated  on  the  date  of  the  accident. 


The  last  report  of  blue  water  leakage  on  the  accident  airplane  was  in  May  1994,  when  blue  fluid  was 
found  aft  of  the  main  entry  door.  The  area  was  inspected  and  cleaned,  and  no  additional  leakage  was  noted. 

The  thrust  reverser  sync-lock  system  was  designed  to  minimize  the  possibility  of  in-flight  thrust 
reverser  deployment. 

Boeing’s  737-SL-78-26  was  dated  February  11,  1993,  6  days  after  USAir’s  maintenance  personnel 
indicated  that  they  accomplished  the  deactivation  of  the  thrust  reverser  sync-lock  system  (according  to  work 
card  No.  3-72-93853,  dated  February  5,  1993).  According  to  USAir  personnel,  they  deactivated  the  thrust 
reverser  sync-lock  system  in  response  to  an  advance  copy  of  737-SL-78-26,  which  they  received  in  early 
February  1993.  The  installation  and  subsequent  deactivation  were  completed  during  the  same  maintenance 
visit. 

^  After  the  accident,  the  FAA  issued  Airworthiness  Directive  (AD)  94-21-05  Rl,  which  became 
effective  November  25, 1994.  The  AD  required  the  installation  of  the  sync-lock  feature  on  all  737-300,  -400, 
and  -500  series  airplanes. 
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Maintenance  records  also  indicated  that  the  main  rudder  power  control  unit  (PCU) 
was  replaced  during  the  last  Q  check  (February  1993)  after  leakage  was  observed  at  the 
rear  seal.  Three  of  the  Q  check  work  cards  described  the  work  pertaining  to  the  main 
rudder  PCU  as  follows: 

Work  card  No.  J3-64-55501-2  indicated  that  the  PCU  “reference  rod  [had] 
been  scraped  against  [the]  vertical  fin  liner  structure”  and  that  the  damaged 
area  was  cleaned  up,  inspected,  and  “found  to  be  within  limits. 

Work  card  No.  J3-65-27500-2  indicated  that  the  “main  bolt  which  attaches 
power  control  unit  to  rudder  attach  point  has  slight  step  worn  in  it.”  The 
worn  bolt  was  replaced. 

Work  card  No.  J3-65-27500-3  indicated  that  the  “rod  bearing  on  [the]  PCU 
at  [the]  PCU  to  rudder  attach  point  has  rough  feel  during  operation”  and 
that  the  PCU  was  replaced  “due  to  leakage.” 

The  replacement  main  rudder  PCU,  S/N  1596 A,  was  examined  and  tested 
thoroughly  during  the  accident  investigation.  (For  additional  information  regarding  the 
main  rudder  PCU,  see  sections  1.6. 3. 2  and  1.16.5.) 

USAir’s  maintenance  records  showed  that  the  periodic  rudder  functional  checks 
required  by  Airworthiness  Directive  (AD)  94-01-07  (explained  in  more  detail  in  sections 
1.6. 3.2.1  and  1.18.5)  were  successfully  performed  on  the  accident  airplane  three  times  in 
1994.  The  initial  check  was  performed  on  March  21,  1994,  at  22,368  flight  hours  and 
13,511  flight  cycles.  Repetitive  inspections  were  performed  on  June  14,  1994,  at  23,100 
hours  and  13,994  cycles  and  on  August  8,  1994,  at  23,572  hours  and  14,298  cycles.  The 
maintenance  records  also  indicated  that  the  accident  airplane  was  in  compliance  with  all 
other  applicable  ADs  at  that  time. 

1.6.1. 2  Events  on  Earlier  Flights 

The  accident  airplane  departed  Windsor  Locks,  Connecticut,^^  about  0620  on  the 
morning  of  September  8,  1994,  and  was  flown  to  Syracuse  and  Rochester,  New  York; 
Charlotte;  and  Jacksonville  (where  the  accident  flight  crew  boarded).  The  pilots  of  the 
earlier  flights  reported  no  difficulties  with  the  airplane.  However,  a  passenger  who  was  on 
the  accident  airplane  when  it  arrived  in  Jacksonville  reported  an  "abrupt  maneuver  during 
the  approach  to  Jacksonville.  Subsequent  examination  of  the  FDR  information  for  this 
approach  indicated  a  roll  of  9°  to  the  left  followed  by  a  roll  of  12  to  the  right.  The  FDR 
indicated  the  event,  from  the  beginning  of  the  left  roll  to  the  return  to  wings-level  attitude, 
occurred  over  20  seconds.  The  pilots  of  that  flight  stated  that  they  did  not  notice  any 
unusually  abrupt  maneuvers.  They  suggested  that  a  slight  roll  might  have  occurred  as  they 
changed  to  different  modes  of  the  autopilot,  but  they  had  no  recollection  of  an  unusual  roll 
event.  The  pilots  stated  that  the  airplane’s  systems  and  controls  functioned  normally 
during  the  flight. 


”  The  accident  airplane  remained  in  Windsor  Locks  on  the  night  of  September  7,  1994,  where  a 
maintenance  transit  check  was  accomplished.  Records  indicated  that  only  routine  service  was  performed  and 
that  no  discrepancies  were  noted  during  this  inspection. 
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The  Safety  Board  also  received  postaccident  passenger  reports  of  an  unusual 
sound  that  occurred  during  the  flight  immediately  preceding  the  accident  flight,  from 
Charlotte  to  ORD.  An  off-duty/commuting  US  Air  captain  who  traveled  on  flight  1181 
from  Jacksonville  to  Charlotte  and  then  to  ORD  occupied  a  seat  in  the  passenger  cabin 
during  the  flight  from  Jacksonville  to  Charlotte;  however,  he  occupied  the  observer’s 
jumpseat^^  in  the  cockpit  during  the  flight  from  Charlotte  to  ORD  because  of  a  full 
passenger  load.  According  to  the  off-duty  captain,  during  the  flight  from  Charlotte  to 
ORD,  a  passenger  in  the  forward  cabin  told  the  flight  attendant  that  he  heard  an  unusual 
noise,  and  the  flight  attendant  informed  the  flight  crew  of  the  passenger’s  comment.  While 
the  flight  crew  attempted  to  determine  the  origin  of  the  noise,  the  off-duty  captain  noted 
that  the  cabin  address  microphone  had  come  out  of  its  holder.  The  microphone  was 
returned  to  its  holder,  and  there  were  no  further  reports  of  unusual  noises. 

During  the  Safety  Board’s  January  1995  public  hearing  regarding  this  accident,^’ 
the  off-duty  USAir  captain  indicated  that  airplane  operations  during  the  two  flights 
appeared  to  be  "normal."  He  stated  that  the  flight  and  cabin  crew  interaction  appeared  to 
be  routine  and  professional  and  that  both  pilots  seemed  to  be  friendly  and  in  good  spirits. 
He  observed  no  problems  with  the  airplane  and  reported  that  the  captain  was  performing 
the  PF  duties  for  the  leg  from  Charlotte  to  Chicago. 

1.6.2  Boeing  737  Hydraulic  System  Information 

Hydraulic  power  on  the  737-300  is  provided  by  three  independent  hydraulic 
systems,  each  of  which  is  capable  of  operating  pressures  of  about  2,950  pounds  per  square 
inch  (psi).  The  systems  are  designated  as  hydraulic  system  A,  hydraulic  system  B,  and  the 
standby  hydraulic  system.  Hydraulic  systems  A  and  B  have  independent  hydraulic 
reservoirs  and  two  hydraulic  pumps  each.  Although  hydraulic  systems  A  and  B  normally 
operate  together  to  provide  dual  hydraulic  power  for  primary  flight  controls  (ailerons, 
elevators,  and  rudder),  either  system  is  capable  of  powering  the  flight  controls  alone  if  the 
other  system  fails.  Further,  if  one  of  the  hydraulic  pumps  in  either  the  A  or  B  systems  were 
to  fail,  the  remaining  pump  has  sufficient  capacity  to  provide  full  flight  control  authority 
for  its  respective  system  operation. 

The  737-300  hydraulic  system  A  is  powered  by  one  engine-driven  hydraulic  pump 
(EDP)  and  one  electrical-powered  hydraulic  pump.  Hydraulic  system  A  provides  power 
for  the  ailerons,  rudder,  elevators,  landing  gear,  normal  nosewheel  steering,  alternate 
brakes,  inboard  flight  spoilers,  left  engine  thrust  reverser,  ground  spoilers,  the  A  system 
autopilot,  and  the  autoslats  through  the  power-transfer  unit.  The  737-300  hydraulic 


The  cockpit  was  configured  with  two  crew  seats  (captain  on  the  left  and  first  officer  on  the  right)  with 
the  throttle/communication/navigation  console  located  between  them.  The  observer  seat  is  located  behind 
the  flight  crew  seats  and  console  and  in  front  of  the  cockpit-to-cabin  access  door. 

The  Safety  Board  conducted  two  sessions  of  its  public  hearing  regarding  this  accident.  The  first 
session  was  held  in  Pittsburgh  in  January  1995,  and  the  second  session  was  held  in  Springfield,  Virginia,  in 
November  1995.  Although  it  is  unusual  for  the  Safety  Board  to  hold  two  sessions  of  a  public  hearing,  the 
Board  believed  that  a  second  session  was  warranted,  given  the  scope  and  technical  depth  of  the  accident 
investigation. 
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system  B  is  also  powered  by  one  EDP  and  one  electrical-powered  hydraulic  pump. 
Hydraulic  system  B  provides  power  for  the  ailerons,  rudder,  elevators,  trailing  edge  flaps, 
leading  edge  flaps  and  slats,  autoslats,  normal  brakes,  outboard  flight  spoilers,  right 
engine  thrust  reverser,  yaw  damper,  the  system  B  autopilot,  autobrakes,  landing  gear 
transfer  unit,  and  alternate  nose  wheel  steering  (if  installed). 

The  737-300  standby  hydraulic  system  is  unpressurized  during  normal  operations. 
This  system  is  powered  by  an  electric  pump  and  can  be  activated  manually  by  the  pilots  by 
arming  “ALTERNATE  FLAPS”  or  selecting  the  hydraulic  system  A  or  B  flight  control 
switch  to  “STBY  RUD”  (standby  rudder)  on  the  overhead  panel  in  the  cockpit.^*  The 
737-300  standby  hydraulic  system  will  activate  automatically  in  the  event  of  a  loss  of 
hydraulic  system  A  or  B  pressure  during  takeoff  or  landing.  (For  automatic  operation, 
speed  must  be  greater  than  60  knots,  or  the  airplane  must  be  airborne  with  wing  flaps 
extended.)  The  standby  hydraulic  system  powers  the  standby  rudder  system,  provides  an 
alternate  source  of  power  for  both  thrust  reversers,  and  extends  the  leading  edge  flaps  and 
slats  in  the  ALTERNATE  FLAPS  mode.  In  the  event  of  a  failure  of  both  hydraulic  systems 
A  and  B,  the  ailerons  and  elevators  can  be  operated  manually  without  hydraulic  power 
(referred  to  as  manual  re  version). The  rudder  has  no  manual  reversion  capability  but  can 
be  operated  with  the  standby  hydraulic  system.'*® 

Controls  and  indicators  for  hydraulic  systems  A  and  B  are  located  on  the  first 
officer’s  overhead  panel  in  the  cockpit;'**  they  include  on/off  switches  for  each  pump  and 
amber  lights  that  indicate  hydraulic  system  low  pressure  or  overheat  conditions  for  the 
electrically  driven  pumps.  Figure  2  illustrates  the  hydraulic  system  panel. 


During  normal  operation,  the  hydraulic  system  A  and  B  flight  control  switches  would  be  in  the  ON 
position,  and  the  ALTERNATE  FLAPS  switch  would  be  in  the  OFF  position. 

According  to  Boeing,  manual  reversion  requires  approximately  40  pounds  of  force  at  the  control 
wheel  to  initiate  a  roll  and  approximately  60  pounds  of  force  at  the  control  column  to  initiate  a  pitch  change. 

Although  the  737  rudder  technically  has  no  manual  reversion  capability,  it  is  possible  for  a  pilot  (with 
sufficient  rudder  pedal  force)  to  command  some  rudder  movement  with  no  hydraulic  system  power. 

Although  located  on  the  first  officer’s  overhead  panel,  the  hydraulic  system  control  panel  is 
accessible  to  both  pilots. 


Factual  Information 


17 


Aircraft  Accident  Report 


Factual  Information 


18 


Aircraft  Accident  Report 


1. 6.2.1  Hydraulic  System  Maintenance 

USAir’s  maintenance  records  indicated  that  the  accident  airplane  had  been 
serviced  at  the  time  of  manufacture  with  Skydrol  LD4  hydraulic  fluid  manufactured  by 
Monsanto/^  According  to  Boeing,  it  ensures  that  the  particulate  count  in  the  hydraulic 
systems  of  newly  delivered  airplanes  meets  the  cleanliness  requirement  of  National 
Aerospace  Standard  (NAS)  1638  Class  9.  According  to  NAS  1638,  “Cleanliness 
Requirements  of  Fluid  Used  in  Hydraulic  Systems,”  the  “cleanliness  limit  of  the 
representative  fluid  sample  from  parts,  assemblies,  lines  and  fittings  shall  not  exceed  the 
permissible  maximum  contamination  limits  of  the  specified  class... in  Table  I....  NAS 
1638  Table  I  lists  hydraulic  fluid  cleanliness  limits  by  particle  count  and  size,  ranging 
from  Class  00  to  Class  12.  Table  2  shows  excerpts  from  the  NAS  table.^^ 


Table  2.  Hydraulic  fluid  cleanliness  limits  from  NAS  1638  Table  I. 
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Boeing's  Maintenance  Planning  Document  recommends  the  replacement  of  the 
hydraulic  system  A  and  B  filters  at  C  check  intervals  and  the  replacement  of  filters  located 
at  the  flight  control  system  PCUs  "on  condition'"^  during  maintenance  of  the  filters’ 
respective  components.  USAir’s  maintenance  program  incorporated  these  recommended 
replacement  intervals. 

Boeing’s  737  Maintenance  Manual  (MM)  did  not  recommend  any  specific  interval 
for  the  sampling  or  replacement  of  the  hydraulic  fluid  during  the  life  cycle  of  the  airplane. 
However,  section  29-15-00  in  the  MM  (pages  601-606),  which  describes  Boeing’s 
recommended  “Hydraulic  Systems  A,  B,  and  Standby  ^Inspection  Check  procedures 
and  limits,  states  the  following  on  page  601  (dated  November  15, 1993). 

The  operational  environment  of  the  airplane  hydraulic  system  can  affect 
the  service  life  of  the  hydraulic  fluid.  You  make  a  decision  to  take  a  sample 
of  the  hydraulic  fluid  for  analysis  if  you  find  that  it  is  necessary  from  your 
service  experience....  If  the  fluid  properties  are  greater  than  the 
limits. . .replace  some  quantity  of  fluid  with  new  fluid  until  the  fluid 
properties  agree  with  the  limits  shown. 


Skydrol  LD4  is  a  phosphate  ester  hydraulic  fluid.  It  is  part  of  the  Skydrol  family  of  fire-resistant 
hydraulic  fluids  and  meets  the  airframe  manufacturer’s  specifications  for  viscosity,  flashpoint,  and  moisture 
content  as  a  Type  IV  fluid.  It  has  been  used  commercially  since  1978. 

The  symbol  p  in  table  2  represents  the  unit  of  measurement  termed  a  micron,  which  is  1/1,000  of  a 
millimeter.  For  a  point  of  reference,  a  0.5 -millimeter  mechanical  pencil  is  500  microns  in  diameter. 

Replacement  “on-condition”  means  that  the  component  or  part  is  removed/replaced  only  after  a 
defect  or  anomaly  is  noted  during  an  inspection.  The  replacement  is  not  based  on  a  time  or  cycle  limit. 
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During  postaccident  discussions,  Boeing  personnel  stated  that  fluid  sampling  (or 
replacement/replenishment)  intervals  were  to  be  established  by  the  operator  (along  with 
the  operator’s  hydraulic  fluid  supplier)  based  on  service  experience  and  the  operational 
environment.  USAir’s  maintenance  program  did  not  include  a  requirement  to  sample  or 
replace  the  hydraulic  fluid  in  the  systems,  and  such  sampling  or  replacement  of  hydraulic 
fluid  were  not  required  by  the  FAA.  The  Safety  Board  examined  hydraulic  fluid  samples 
from  the  accident  airplane  during  the  investigation  (see  section  1.16.5.4.3  for  details).'^^ 

1.6.3  Boeing  737  Flight  Control  Systems 

The  flight  controls  on  the  737  are  the  ailerons,  flight  spoilers,  elevators,  horizontal 
stabilizer,  rudder,  flaps,  and  slats.  Flight  control  about  the  longitudinal  (roll)  axis  of  the 
airplane  is  provided  by  an  aileron  on  each  wing  assisted  by  two  flight  spoilers.  Flight 
control  about  the  lateral  (pitch)  axis  is  provided  by  the  horizontal  stabilizer  and  two 
elevators.  Flight  control  about  the  vertical  or  directional  (yaw)  axis  is  provided  by  the 
single-panel  rudder.'*^  The  ailerons  and  flight  spoilers  (roll  control)  are  operated  by 
moving  the  control  wheel  clockwise  or  counterclockwise,**^  the  elevator  (pitch  control)  is 
operated  by  moving  the  control  column  forward  or  aft,  and  the  rudder  (directional/yaw 
control)  is  operated  by  moving  either  the  right  or  left  rudder  pedal  forward  or  aft.  Figure  3 
depicts  the  three  axes  of  motion,  and  figure  4  shows  the  flight  control  surface  locations. 

Boeing  stated  that  the  737  roll  and  yaw  control  systems  were  designed  to  be 
capable  of  countering  the  effects  of  failures  (such  as  loss  of  power  on  one  engine,  flap  and/ 
or  slat  asymmetries,  and  hydraulic  system  failure)  and  achieve  the  desired  crosswind 
control  capability.  According  to  Boeing,  the  737  is  aerodynamically  cross-coupled  (as  are 
most  airplanes);  that  is,  motions  about  the  roll  and  the  yaw  axes  constantly  interact  and 
affect  each  other  in  flight.  Thus,  any  yawing  motion  (sideslip)  would  cause  the  airplane  to 
roll  unless  countered  by  the  control  wheel.  The  737  rudder  system  is  discussed  in  greater 
detail  in  section  1. 6.3.2. 

1. 6.3.1  Auto-Flight  System 

When  engaged,  the  737-300  AFS  provides  control  commands  to  the  airplane’s 
ailerons,  flight  spoilers,  horizontal  stabilizer,  and  elevators  to  reduce  pilot  workload  and 
provide  for  smoother  flight.  The  AFS  does  not  provide  control  commands  to  the  airplane’s 
rudder  system.  A  yaw  damper  system  automatically  stabilizes  the  airplane  about  its  yaw 
axis  by  limiting  yaw  motions  caused  by  atmospheric  disturbance  or  the  airplane  (an 


On  October  18,  1996,  the  Safety  Board  issued  Safety  Recommendation  A-96-116,  asking  the  FAA  to 
“define  and  implement  standards  for  in-service  hydraulic  fluid  cleanliness  and  sampling  intervals  for  all 
transport-category  aircraft.”  See  section  1.18.11.5  for  a  full  discussion  of  the  FAA’s  response  to  this 
recommendation. 

For  more  information  about  the  737  rudder  design,  see  section  I.6.3.2. 

A  clockwise  control  wheel  input  commands  roll  in  a  right-wing-down  (RWD)  direction,  whereas  a 
counter-clockwise  control  wheel  input  commands  roll  in  a  left-wing-down  (LWD)  direction.  In  this  report, 
clockwise  and  counter-clockwise  control  wheel  inputs  will  be  described  as  right  and  left  control  wheel 
inputs,  respectively. 


^Center  of  gravity 
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Figure  3.  Three  axes  of  motion. 
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Figure  4.  Boeing  737  flight  control  surface  locations. 
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inherent  characteristic  of  all  swept-wing  airplanes).  Section  1. 6.3.2  contains  additional 
details  about  the  yaw  damper  system.  Rudder  trim  control  during  flight  is  maintained  by 
the  pilots  with  automatic  assistance  from  the  yaw  damper. 

The  AFS  consists  of  the  autopilot  flight  director  system  and  the  autothrottle. 
Within  the  autopilot  flight  director  system,  commands  from  two  flight  control  computers 
move  the  related  flight  controls  (elevators,  stabilizer  trim,  ailerons,  and  flight  spoilers) 
through  the  hydraulic  systems.  The  autopilot  flight  director  system  mode  control  panel 
(MCP)  is  located  on  the  glareshield  between  the  pilot  positions  and  provides  coordinated 
control  of  the  autopilot  and  flight  director  (FD).'**  The  MCP  contains  power  switches; 
indicator  lights;  flight  mode  selectors;  and  airspeed,  altitude,  vertical  speed,  heading,  and 
bank  angle  selectors/displays.  Figure  5  shows  a  737  MCP  display.  The  autothrottle  moves 
thrust  levers  to  maintain  airspeeds  and/or  thrust  settings  selected  by  the  pilots  and/or 
calculated  by  the  flight  management  computer.  The  autothrottle  is  armed  by  a  switch  on 
the  MCP  and  is  activated  by  the  takeoff/go-around  (TOGA)  switches  on  the  throttles. 
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Note:  Autothrottle  is  depicted  as  A/T,  and  autopilot  is  depicted  as  A/P. 

Figure  5.  Boeing  737  MCP  display. 


Page  14-15-1  of  USAir’s  737-300  and  -400  Pilot’s  Handbook,  under  the  heading 
“Autopilot  Engagement  Criteria,”  states  that  the  two  autopilot  flight  control  computers  are 
engaged  with  separate  switches,  each  of  which  can  be  in  one  of  three  positions: 
mechanically  latched  in  the  OFF  position,  magnetically  held  in  the  control  wheel  steering 
(CWS)  or  in  the  command  (CMD)  position,"^^  or  magnetically  released  from  the  CWS  or 
the  CMD  position.  According  to  Boeing’s  737  Pilot’s  Handbook,  manually  overriding 
autopilot  commands  with  the  control  wheel  or  control  column  does  not  disengage  the 
autopilot  but  shifts  autopilot  control  from  CMD  to  CWS  mode.^®  Manual  override  can 
shift  the  autopilot  from  CMD  to  CWS  in  the  pitch  and  roll  axes  separately  or  together, 
depending  on  the  inputs  made  by  the  pilot.  When  the  airplane  is  operating  in  the  CWS 
mode  and  the  pilot  is  not  exerting  force  on  the  control  column  or  control  wheel,  the 


The  FD  provides  command  bar  “pointers”  on  the  attitude  indicator  display  to  guide  pilots  when  hand 
flying  the  airplane. 

With  CWS  engaged,  the  autopilot  maneuvers  the  airplane  in  response  to  control  pressure  applied  by 
either  pilot.  The  control  pressure  is  similar  to  that  required  for  manual  flight,  and  the  use  of  CWS  does  not 
disengage  the  autopilot.  With  CMD  engaged,  the  autopilot  will  control  the  airplane  according  to  the  mode 
selected  via  the  Mode  Selector  Switches,  which  include  Altitude  Hold,  Vertical  Speed,  Level  Change, 
Vertical  Navigation,  VOR  Localizer,  Lateral  Navigation,  and  Heading  Select. 

If  both  autopilots  are  engaged  (that  is,  for  a  dual-channel  autoland  operation),  the  autopilots  will  not 
shift  from  CMD  mode  to  CWS  mode. 
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autopilot  will  attempt  to  maintain  constant  pitch  and  bank  attitude  or,  under  certain 
circumstances,  to  roll  level  and  maintain  the  previously  selected  altitude. 

A  magazine  article  published  in  Boeing’s  October  through  December  1995  issue 
of  Airliner,  entitled  “737  Directional  Control  System,”  stated  that  when  a  “force  of 
10  pounds  is  applied  to  the  yoke,  the  control  wheel  moves  and  the  autopilot  reverts  into 
CWS  [mode].”  The  article  indicated  that  the  autopilot  would  continue  to  function  in  the 
CWS  mode  until  the  CMD  mode  was  reselected  or  the  autopilot  was  disengaged.  The 
article  also  stated  the  following:^^ 

Normally  in  CWS,  pilots  use  wheel  input  rates  of  5  to  10  degrees  per 
second.  If  the  wheel  is  turned  at  a  high  rate  (40  degrees  per  second,  or 
more),  then  the  force  required  to  turn  the  wheel  approximately  triples.  This 
happens  because  the  autopilot  actuators  can  not  respond  fast  enough  and 
are  being  forced  by  the  pilot’s  input.  So,  for  a  very  quick  wheel  motion,  the 
lateral  control  forces  can  noticeably  increase,  but  the  corresponding  roll 
rate  doesn’t. 

According  to  USAir’s  737-300/400  Pilot’s  Handbook,  the  autopilot  disengages 
under  the  following  circumstances: 

•  Pressing  either  [autopilot]  disengage  switch. 

•  Pressing  either  TOGA  switch  with  a  single  [autopilot]  engaged  in  CWS  or 
CMD  below  2,000  feet  RA  [radio  altitude]. 

•  Pressing  either  TOGA  switch  after  touchdown  with  both  [autopilots]  engaged 
in  CMD. 

•  Moving  the  [autopilot]  engage  switch  to  OFF. 

•  Activating  either  pilot’s  control  wheel  trim  switch. 

•  Moving  the  stabilizer  trim  autopilot  cutout  switch  to  CUTOUT. 

•  Loss  of  respective  hydraulic  system  pressure. 

•  Either  left  or  right  IRS  [inertial  reference  system]  failure  or  FAULT  light 
illuminated. 

•  Loss  of  electrical  power  or  a  sensor  input  which  prevents  proper  operation  of 
the  engaged  [autopilot]  and  mode. 

Page  14-55-1  of  USAir’s  737-300/400  Pilot’s  Handbook  describes  the  autopilot 
disengage  switches,  which  are  located  on  the  outer  grips  of  each  control  wheel.  The 
handbook  states  that,  if  a  pilot  presses  the  autopilot  disengage  switch  on  either  control 
wheel,  the  switch  “disengages  both  [autopilots].  [Autopilot]  disengage  lights  flash  and 
[autopilot]  disengage  warning  tone  sounds  for  a  minimum  of  2  seconds.  Second  push 
extinguishes  [autopilot]  disengage  lights  and  silences  disengage  warning  tone.” 


This  description  of  control  wheel  forces  was  supported  in  a  September  26, 1995,  letter  from  Boeing’s 
Director  of  Air  Safety  Investigation  to  the  Safety  Board. 
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1 .6.3.2  Rudder  Control  System 

The  737-300  has  a  single  rudder  panel  actuated  by  a  single  hydraulic  rudder  PCU. 
A  standby  rudder  actuator  is  available  to  move  the  rudder  if  hydraulic  systems  A  and/or  B 
fail.  According  to  a  Safety  Board  review  of  large  transport-category  airplanes  (including 
Boeing,  McDonnell  Douglas,  Airbus,  and  Lockheed  models),  the  737  is  the  only  twin 
wing-mounted  engine,  large  transport-category  airplane  designed  with  a  single  rudder 
panel  and  single  rudder  actuator.  All  other  large  transport-category  airplanes  with  twin 
wing-mounted  engines  were  designed  with  a  split  rudder  panel,  multiple  hydraulic 
actuators,  or  a  mechanical/manual/trim  tab  rudder  actuation  system. 

Pilot  control  of  the  737-300  rudder  is  transmitted  in  a  closed-loop  system  from  the 
pilots’  rudder  pedals  in  the  cockpit  through  a  single  cable  system  to  the  airplane’s  tail 
section  and  then  through  linkages  to  the  main  rudder  PCU  and  a  standby  rudder  PCU  in 
the  aft  portion  of  the  vertical  stabilizer.  The  rudder  pedals  at  each  pilot  position  are  located 
on  either  side  of  the  control  column  stem,  which  is  protected  within  a  housing  (commonly 
termed  the  “doghouse”  by  737  flight  crews)  that  is  located  between  each  pilots’  lower  legs 
at  the  pilot  positions.  Figures  6  and  6a  show  the  737  rudder  system. 


Left  Rudder  Motion 


^Rudder  Hinge 
Line 


^Rudder  Main  PCU 

Aft  Rudder  Power 
Control  Unit  Input  Rod  | 

Electric  Rudder  Trim  Actuator 


Figure  6.  Boeing  737  rudder  system. 
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Figure  6a.  Detailed  view  of  737  aft  rudder  system  controls  and  linkages. 


According  to  Boeing  personnel,  because  of  the  engine  placements  on  the  wings, 
the  737  rudder  has  to  be  sufficiently  powerful  to  effectively  counter  the  effects  of  a  loss  of 
engine  power  on  one  side  during  a  maximum  gross  weight  takeoff  at  low  airspeeds, 
especially  in  crosswind  conditions.  A  loss  of  engine  power  on  one  side  of  the  airplane 
would  result  in  a  large  yawing  moment,  in  the  direction  of  the  inoperative  engine, 
produced  by  thrust  from  the  operating  engine.  The  loss  of  engine  power  can  be  countered 
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by  a  rudder  input  in  the  opposite  direction  (for  example,  left  pedal  input  to  counter  loss  of 
power  on  the  right  engine).^^ 

When  properly  installed  and  rigged,  the  737-300  main  rudder  PCU  can  command  a 
maximum  deflection  of  26°  to  the  right  and  the  left  of  the  rudder’s  neutral  position  (under 
no  aerodynamic  load  conditions);  the  rudder  can  travel  to  those  limits  at  a  maximum  rate 
of  66°  per  second.  (The  737  main  rudder  PCU  is  capable  of  producing  about  5,900  pounds 
of  output  force  to  move  the  rudder  when  both  hydraulic  systems  are  operating  at  their 
normal  operating  pressure — 2,950  psi  each.)  The  rudder  pedals  move  about  1  inch  (from 
their  neutral  position)  for  every  6.5°  of  rudder  surface  travel  (under  no  aerodynamic  load 
conditions)  until  the  rudder  pedals  reach  their  maximum  travel  of  about  4  inches 
(backward  and  forward)  from  the  neutral  position.  The  rudder  pedal  stops  at  the  pilots’ 
forward  rudder  control  quadrant  are  set  to  provide  a  mechanical  stop  at  28°  of  rudder 
travel  (exceeding  the  rudder’s  travel  authority)  because  compliance  in  the  cable  system 
(cable  stretch)  may  require  rudder  pedal  travel  beyond  the  4-inch  limit  to  achieve  the  full 
travel  rudder  movement  of  26°.  With  the  aerodynamic  loads  encountered  in  flight,  the 
available  amount  of  rudder  surface  travel  is  reduced.  The  maximum  amount  of  rudder 
travel  available  for  an  airplane  at  a  given  flight  condition/configuration  is  referred  to  as 
the  rudder’s  “blowdown”  limit.^^ 

The  rudder  feel  and  centering  unit  is  attached  to  the  aft  rudder  torque  tube  in  the 
vertical  fin,  forward  of  the  main  rudder  PCU  (see  figure  6).  This  unit  holds  the  rudder  at 
the  neutral  (or  trimmed)  position  when  no  rudder  pedal  force  is  applied.  It  also  provides  a 
feedback  force  to  the  rudder  pedals  that  increases  as  the  rudder  pedals  are  depressed.  The 
pilot  rudder  pedal  force  required  for  full  rudder  deflection  is  about  70  pounds;  however, 
the  rudder  trim  system  allows  the  pilots  to  maintain  a  rudder  deflection  without  having  to 
maintain  a  rudder  pedal  force. 

During  normal  and  abnormal  operations,  the  rudder  can  be  moved  beyond  the 
movement  commanded  by  the  hydraulic  actuator  through  a  pilot’s  application  of  force  on 
the  rudder  pedals.  (Normal  operation  of  the  rudder  refers  to  the  rudder’s  motion,  or  lack 
thereof,  resulting  from  normal  PCU  servo  valve  operation.  Abnormal  operation  refers  to 
the  rudder’s  motion  that  results  from  a  PCU  servo  valve  that  is  functioning  abnormally,  for 
example,  because  of  a  rudder  jam  and/or  reversal.^'*  Both  types  of  operation  can  include 
rudder  movement  within  the  range  of  the  rudder  authority  on  the  ground  and/or  to  the 
rudder’s  in-flight  blowdown  limit.) 


The  rudders  on  airplanes  with  fuselage-mounted  engines  are  typically  less  powerful  than  the  rudders 
on  airplanes  with  wing-mounted  engines.  The  rudders  for  fuselage-mounted  engine  airplanes  do  not  have  to 
be  designed  to  counter  as  significant  an  asymmetrical  thrust  effect  in  the  event  of  a  loss  of  power  on  one 
engine.  Because  the  rudder  on  airplanes  with  fuselage-mounted  engines  is  less  powerful,  the  consequences 
of  a  rudder  hardover  are  less  serious;  thus,  the  Safety  Board’s  investigation  did  not  consider  this  type  of 
airplane. 

Rudder  blowdown  is  the  maximum  rudder  angle  resulting  from  a  pilot-commanded  full  rudder  input 
under  the  existing  flight  conditions.  It  represents  a  balance  between  the  aerodynamic  forces  acting  on  the 
rudder  and  the  mechanical  forces  produced  by  the  PCU.  The  maximum  rudder  angle  can  be  increased 
beyond  that  produced  by  the  hydraulic  force  if  the  pilot  exerts  sufficient  force  on  the  rudder  pedals. 

Rudder  reversals  are  discussed  in  section  1.16.5.4.7. 
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During  normal  rudder  operation,  if  a  pilot  applies  a  sufficiently  rapid  rudder  pedal 
input  (the  rudder  pedal  must  move  faster  than  the  PCU’s  ability  to  respond  to  the  input), 
the  PCU  input  crank  would  contact  the  PCU  external  body  stop  (manifold  stop), 
transmitting  force  from  the  rudder  pedal  input  to  the  rudder  surface  through  the  main 
rudder  PCU  and  the  rudder  system's  linkages.  Also,  the  additional  force  applied  by  the 
pilot  would  increase  the  rudder  PCU  output  force,  moving  the  rudder  farther  in  the 
intended  direction  of  travel.  The  rudder  feel  and  centering  unit  would  oppose  the  rudder 
pedal  force  (decrease  the  force  applied  by  the  pilot’s  foot)^^  with  about  9  to  70  pounds  of 
force,  depending  on  how  far  the  rudder  is  away  from  its  centered  position. 

During  normal  operation  of  the  rudder  in  flight,  if  a  pilot  applied  between  9  and  70 
pounds  of  force  to  a  rudder  pedal,  the  rudder  would  move  in  response  until  it  reached  its 
blowdown  limit  (when  the  aerodynamic  forces  acting  on  the  rudder  surface  equal  the 
hydraulic  actuator  force).  According  to  Boeing  engineers,  if  the  pilot  were  to  then  apply 
additional  force  to  the  rudder  pedal,  the  pedal  would  move  about  1  inch  farther,  with  no 
corresponding  movement  of  the  rudder,  as  the  slack  in  the  rudder  linkage  system  is 
removed  and  the  external  input  crank  contacts  the  external  stop.  Any  additional  pilot 
application  of  force  to  the  rudder  pedal  would  result  in  rudder  pedal  movement  of  about 
1  inch  for  each  300  pounds  of  rudder  pedal  force,  which  in  turn  would  move  the  rudder 
surface  slightly  beyond  the  maximum  deflection  possible  from  the  hydraulic  actuator  force. 

During  a  servo  valve  jam/rudder  reversal,  the  rudder  pedal  force  from  a  pilot 
resisting  the  jam  would  cause  the  rudder  to  move  in  the  direction  opposite  the  jam  (toward 
the  rudder’s  neutral  position).  The  feel  and  centering  unit  would  add  to  the  rudder  pedal 
force.  As  a  pilot  applied  force  to  a  rudder  pedal  in  opposition  to  the  jam/reversal,  the  first 
inch  of  movement  of  the  pedal  would  cause  the  PCU  input  crank  to  move  to  the  PCU 
manifold  body  stop.  After  the  PCU  input  crank  contacts  the  manifold  body  stop, 
approximately  300  additional  pounds  of  pilot  rudder  pedal  force  would  be  required  to 
move  the  rudder  pedal  each  additional  1  inch  of  travel  until  the  rudder  pedal  contacts  the 
forward  quadrant  stops.  Pilot  rudder  pedal  force  in  opposition  to  a  jammed/re  versing 
rudder  malfunction  would  reduce  the  deflection  of  the  rudder. 

The  737  rudder  trim  system  allows  the  pilots  to  command  a  steady  rudder  input 
without  maintaining  foot  pressure  on  the  rudder  pedals.  The  primary  purpose  for  rudder 
trim  is  to  compensate  for  the  sustained  large  yawing  moments  generated  by  asymmetric 
thrust  in  an  engine-out  situation.  Pilots  also  sometimes  use  a  small  amount  of  rudder  trim 
during  normal  flight  to  compensate  for  slight  yawing  moment  asymmetries,  such  as  those 
caused  by  flight  control  and  engine  rigging  imperfections.  To  trim  the  rudder  on  the 
737-300,  -400,  and  -500,  the  pilot  uses  an  electrical  trim  motor  activated  by  the  trim 
switch  located  on  the  flight  deck  center  pedestal.  The  rudder  trim  switch  activates  an 
electric  rudder  trim  actuator  (located  near  the  aft  control  torque  tube  in  the  vertical  fin) 
that  rotates  the  feel  and  centering  unit,  thus  changing  the  neutral,  or  zero,  position  of  the 
rudder.^^  The  737-300  electric  rudder  trim  moves  the  rudder  at  a  rate  of  about  O.S""  per 


USAF  ergonomic  studies  indicate  that  the  maximum  rudder  pedal  force  pilots  can  exert  on  the  rudder 
pedals  is  about  500  pounds.  For  additional  information  regarding  pilot  rudder  pedal  force,  see  sections 
1.16.6  and  1.18.8. 
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second  to  the  desired  rudder  trim  deflection;  maximum  rudder  trim  authority  is  ±  16°. 
According  to  USAir’s  737-300  Pilot’s  Handbook,  when  the  rudder  trim  is  used,  the  rudder 
pedals  are  displaced  proportionately. 

The  737  yaw  damper  system  improves  ride  comfort  by  sensing  turbulence-  or 
airplane-generated  yaw  motion  and  countering  the  yaw  with  rudder  surface  movement. 
The  system  is  initially  activated  by  the  yaw  damper  switch  on  the  overhead  panel  in  the 
cockpit  and  is  continuously  engaged  during  normal  operations;  all  inputs  are  automatic 
and  require  no  pilot  action.  The  yaw  damper  system  comprises  the  yaw  damper  control 
switch  and  a  yaw  damper  coupler,  which  includes  a  rate  gyro  that  senses  airplane  motion 
about  the  yaw  axis  and  converts  the  motion  to  an  electrical  signal  that  is  sent  to  the  main 
rudder  PCU.  An  electrohydraulic  servo  valve  (or  transfer  valve)  converts  the  electrical 
signal  from  the  yaw  damper  coupler  to  PCU  motion  by  directing  hydraulic  fluid  from 
hydraulic  system  B  to  move  the  rudder  left  or  right.  The  yaw  damper  system  also  includes 
a  cockpit  indicator  of  yaw  damper  activity. 

In  the  737-300  series,  the  yaw  damper  can  command  up  to  3°  of  rudder  surface 
deflection  in  either  direction  at  a  rate  of  50°  per  second  (when  correctly  assembled/ 
rigged).^’  Rudder  movements  that  result  from  yaw  damper  system  inputs  do  not  move  the 
rudder  pedals. 

Figure  7  shows  the  main  rudder  PCU.  Figure  8  shows  the  main  rudder  PCU 
schematic  and  installation.  Figure  9  depicts  the  rudder,  rudder  trim,  and  yaw  damper 
authority  limits. 


Servo  Control  Valve 


To  trim  the  rudder  on  the  737-100  and  -200,  the  flight  crew  turns  a  knob  on  the  flight  deck  center 
pedestal  that  is  mechanically  connected  to  the  rudder  trim  actuator. 

The  737-300  yaw  damper  was  initially  designed  with  ±  30°  of  rudder  authority.  The  -100  and  -200 
series  airplanes’  yaw  dampers  were  designed  to  command  either  ±  2  or  ±  4°  of  rudder  authority.  Boeing 
indicated  that  units  permitting  ±  2,  3,  or  4°  of  rudder  deflection  may  be  used  interchangeably  on  737-100  and 
-200  series  airplanes,  and  units  permitting  ±  2  or  ±  3°  of  rudder  deflection  may  be  used  interchangeably  on 
737s  in  the  -300,  -400,  and  -500  series.  For  information  regarding  rigging  of  the  yaw  damper  linear  variable 
displacement  transducer  (LVDT),  see  section  1.16.1.2. 
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Figure  9.  Boeing  737-300,  -400  and  -500  rudder,  rudder  trim,  and 
yaw  damper  authority  limits. 

1.6.3.2.1  Main  Rudder  PCU  and  Servo  Valve 

The  main  rudder  PCU  is  powered  by  hydraulic  systems  A  and  B,  each  of  which 
provides  about  3,000  pounds  of  output  force  to  move  the  rudder,  for  a  total  output  force  of 
about  6,000  pounds.  The  main  rudder  PCU  operates  by  converting  either  a  mechanical 
input  from  the  rudder  pedals  or  an  electrical  signal  from  the  yaw  damper  system  into 
motion  of  the  rudder  by  means  of  mechanical  linkages  (summing  levers,  input  cranks,  and 
shafts)  and  a  servo  valve  that  directs  hydraulic  fluid  either  to  extend  or  retract  the  PCU 
actuator  rod  that  moves  the  hinged  rudder  surface. 

The  body  of  the  main  rudder  PCU  is  attached  to  the  airplane  vertical  fin  structure, 
and  the  actuating  rod  is  attached  to  the  rudder.  The  PCU  moves  the  rudder  right  or  left 
when  actuated  by  rudder  pedal  or  trim  input  or  signals  from  the  yaw  damper.  Rudder  pedal 
and  trim  input  are  transmitted  to  the  PCU’s  external  input  crank  through  an  external 
summing  lever  and  linkage.  The  external  input  crank  is  also  moved  by  feedback  from 
motion  of  the  rudder,  which  comes  from  a  mechanical  system  linkage  (see  figure  8).  The 
input  shaft  rotates,  actuating  the  internal  summing  levers  and  moving  the  primary  and 
secondary  slides  of  the  servo  valve. 

The  737  main  PCU  servo  valve  was  designed  by  Boeing  and  is  manufactured  to 
Boeing  specifications  by  Parker  Hannifin  Corporation.  It  is  a  dual-concentric  tandem 
valve  composed  of  a  primary  slide  that  moves  within  a  secondary  slide  that,  in  turn,  moves 
within  the  servo  valve  housing.  The  primary  and  secondary  concentric  slides  are  moved 
by  primary  and  secondary  internal  summing  levers,  which  translate  inputs  from  the  yaw 
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damper^^  and/or  the  external  input  crank  (which  moves  when  a  pilot  steps  on  the  rudder 
pedals)  into  axial  movement  of  the  slides.  Figure  10  shows  an  expanded  view  of  the  servo 
valve. 

When  rudder  motion  is  commanded  (by  the  yaw  damper,  rudder  pedal  input,  and/or 
rudder  trim),  the  internal  input  shaft  moves  the  servo  valve  slides  through  the  internal 
summing  levers  to  connects  hydraulic  pressure  and  return  circuits  from  hydraulic  systems 
A  and  B  so  that  hydraulic  pressure  is  ported  to  the  appropriate  sides  of  the  dual-tandem 
actuator  piston  to  extend  or  retract^^  the  main  rudder  PCU  piston  rod.  At  the  same  time, 
fluid  is  directed  from  the  other  side  of  the  piston  to  the  hydraulic  return  system.  As  the 
rudder  reaches  the  commanded  deflection,  external  linkages  reposition  the  servo  valve’s 
internal  summing  levers  to  nullify  the  initial  command  signal  and  arrest  further  motion. 

During  normal  operation,  the  primary  summing  lever  applies  force  to  move  the 
primary  slide,  and  the  secondary  summing  lever  applies  force  to  move  the  secondary  slide 
as  needed.  The  primary  slide  is  normally  displaced  first,  and  the  secondary  slide  is 
displaced  only  when  the  primary  slide  does  not  provide  enough  hydraulic  flow  to  keep  up 
with  the  input  commanded  by  the  pilots  or  the  yaw  damper  (that  is,  when  the  movement  of 
only  the  primary  slide  is  not  sufficient  to  move  the  rudder  at  the  commanded  rate).  The 
normal  maximum  axial  movement  from  the  neutral  positions  to  the  extreme  travel 
positions  in  either  the  extend  or  retract  directions  is  about  0.045  inch  for  both  the  primary 
and  secondary  slides,  for  a  combined  distance  of  about  0.090  inch.  Both  the  primary  and 
secondary  slides  are  designed  so  that  they  can  move  about  0.018  inch  axially  beyond  their 
normal  operating  range  (overtravel  capability). 

The  two  slides  are  designed  to  provide  approximately  equal  flow.  Thus,  the 
primary  slide  alone  can  provide  a  rudder  rate  of  about  33°  per  second,  and  the  primary  and 
secondary  slides  together  can  provide  a  rudder  rate  of  about  66°  per  second  (under  zero 
aerodynamic  load  conditions). 

The  outside  diameter  surfaces  of  the  primary  and  secondary  slides  are  composed 
of  Nitralloy  135  that,  in  its  prefinished  form  (slightly  larger  in  diameter  than  its  finished 
form),  is  nitrided^^  to  a  depth  from  0.005  to  0.008  inch  to  a  surface  hardness  of  55  to  58  on 


When  the  yaw  damper  solenoid  control  valve  is  energized,  3,000  psi  of  hydraulic  pressure  is  applied 
to  the  transfer  valve,  which  proportionally  converts  electrical  signals  from  the  yaw  damper  coupler  into 
hydraulic  flow  and  control  pressure.  The  control  pressure  moves  the  yaw  damper  actuator  assembly  piston 
(mod  piston),  which  moves  the  pivot  point  of  the  internal  summing  levers.  The  internal  summing  levers 
move  the  primary  and  secondary  slides  of  the  servo  valve  from  neutral,  which  causes  movement  of  the 
pistons  in  the  actuator  assembly.  Movement  of  the  yaw  damper  actuator  piston  generates  a  balancing  signal 
by  the  LVDT,  which  assists  in  returning  the  transfer  valve  to  the  neutral  position.  Feedback,  provided 
through  the  external  summing  lever  and  linkage,  returns  the  slides  of  the  servo  valve  to  near  neutol,  which 
maintains  hydraulic  pressure  to  hold  the  actuator  position  against  the  air  load  while  not  commanding  further 
motion. 

When  the  actuator  moves  in  the  extend  direction,  it  commands  left  rudder;  when  it  moves  in  the 
retract  direction,  it  commands  right  rudder. 

^  Nitriding  is  a  process  in  which  the  surface  of  the  part  is  impregnated  with  nitrogen  to  increase 
hardness. 
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the  Hardness  Rockwell  C  (HRC)  scale.  The  inside  surfaces  of  the  secondary  slide  and  the 
servo  valve  housing  are  made  of  52100  hardened  steel  (surface  hardness  57  to  62  on  the 
HRC  scale).  The  outside  diameter  surfaces  of  the  primary  slide  are  very  close  to  the  inside 
diameter  surfaces  of  the  secondary  slide,  and  the  outside  diameter  surfaces  of  the 
secondary  slide  are  very  close  to  the  inside  diameter  surfaces  of  the  servo  valve  housing. 

In  a  March  18,  1999,  letter,  Parker  advised  the  Safety  Board  that  two  engineering 
documents  from  1966,^’  which  were  produced  during  prototype  testing  of  the  servo  valve, 
revealed  that  dimensional  changes  were  made  to  the  prototype  because  of  conditions  and 
performance  results  observed  during  the  initial  testing.  According  to  the  letter,  a 
March  11,  1966,  Parker  engineering  order  modified  certain  dimensions  in  the  servo  valve 
slightly  to  “insure  accumulated  tolerances  will  not  cause  reverse  flow.”  Additionally,  the 
letter  stated  that  a  December  9,  1966,  Parker  engineering  order  indicated  that  other 
modifications  were  made  “to  preclude  bottoming  of  [the]  secondary  slide  at  the  detent  at 
the  max[imum]  tolerance  stackup.”  According  to  the  letter,  after  the  dimensional  changes 
were  incorporated  into  the  prototype  servo  valve’s  design,  it  passed  the  acceptance  test 
procedure,  and  no  further  flow  problems  were  noted.  Parker  personnel  stated  that  no  servo 
valves  with  the  original  prototype  dimensions  were  provided  to  customers.  The  letter 
further  stated,  “as  we  can  best  determine,  ‘reverse  flow’  was  used  to  refer  to  cross-flow  or 
higher  internal  leakage  in  the  servo  valve  than  is  desirable... but  had  nothing  to  do  with 
reversal  in  the  dual  concentric  servo  valve”  and  indicated  that  “the  reversal  phenomenon 
in  the  servo  valve... was  first  seen  in  the  1992  examination  of  the... United  Airlines 
Boeing  737  rudder  power  control  unit  [which  resulted  from  a  July  16,  1992,  anomaly 
found  during  a  ground  check,  as  discussed  later  in  this  section  and  in  more  detail  in 
sections  1.16.1.1  and  1.18.1.1]— rudder  or  servo  valve  reversal  was  not  an  issue 
recognized  at  the  time  of  the  1966  Engineering  Orders.” 

Before  1989,  the  servo  valve  assembly  engineering  drawings  did  not  specify 
diametrical  clearances  between  the  primary  and  secondary  slides  or  between  the 
secondary  slide  and  servo  valve  housing.  However,  ‘  shop  travelers  (manufacturing 
documents  that  include  instructions  for  specific  tasks)  used  before  1989  indicated  that  the 
minimum  and  maximum  clearances  were  0.00010  and  0.00015  inch,  respectively.  On 
March  14,  1989,  Parker  released  an  engineering  order  that  amended  the  servo  valve 
assembly  drawings  to  specify  minimum  and  maximum  diametrical  clearances  of  0.00015 
and  0.00020  inch,  respectively,  between  the  outside  diameter  of  the  secondary  slide  and 
the  inside  diameter  of  the  servo  valve  housing  assembly  and  between  the  outside  diameter 
of  the  primary  slide  and  the  inner  diameter  of  the  secondary  slide  assembly. 

According  to  Parker,  the  engineering  drawing  clearances  normally  allow  the  servo 
valve  assembly  to  pass  the  functional  testing  that  is  part  of  the  acceptance  test  procedure, 
and  the  servo  valve  components  may  then  be  individually  polished  based  on  functional 
test  results  to  obtain  the  proper  ease  of  movement.  Because  of  the  variability  in 
dimensions  of  individual  servo  valve  primary  and  secondary  slides  and  the  tight 


61  These  documents  were  located  by  Parker  in  response  to  requests  made  in  the  context  of  litigation 
resulting  from  the  US  Air  flight  427  accident. 
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clearances  required  by  the  design,  the  servo  valve  components  are  assembled,  installed, 
and  maintained  as  matched  sets. 

Before  1992,  the  acceptance  test  procedure  for  the  servo  valve  assembly  was  based 
on  compliance  with  performance  standards.  (According  to  Parker,  each  valve  was  to  be 
“trimmed”’’^  until  the  desired  functional  performance  was  obtained.)  Actual  travel  (or 
overtravel)  capability  of  the  primary  and  secondary  slides  had  not  been  measured.  In 
1992,  as  a  result  of  findings  from  the  main  rudder  PCU  anomaly  found  during  a  July  1992 
United  Airlines  ground  check,  Boeing  established  maximum  axial  distances  between 
metering  edges  for  both  the  primary  and  secondary  slides,  and  Parker  instituted  a 
functional  test.  In  addition,  the  FAA  issued  AD  94-01-07,  effective  March  3, 1994,  which 
required  operators  to  test  737  main  rudder  PCUs  at  750-hour  intervals  for  internal 
hydraulic  fluid  leakage  until  they  are  replaced  with  new  PCUs  containing  servo  valves 
designed  to  prevent  secondary  slide  overtravel.  (For  additional  information  regarding  this 
part  of  AD  94-01-07,  see  section  1.18.5  and  appendix  C.) 

In  addition  to  the  functional  testing  performed  on  each  individual  main  rudder 
PCU  servo  valve,  one  valve  was  subjected  to  qualification  testing  at  the  time  of  the  737’s 
initial  certification.®^  The  purpose  of  this  qualification  testing  was  to  ensure  that  the  servo 
valve  would  be  able  to  withstand  the  operational  and  environmental  stresses  expected 
during  its  life. 

1 .7  Meteorological  Information 

The  official  PIT  hourly  weather  observation  taken  at  1852  stated: 

sky  condition — clear,  visibility — 5  miles,  temperature — 73°  Fahrenheit  (F),  dew 
point — 1°F,  wind — 250°  at  7  knots,  altimeter  setting — 30.10  inches  Hg  [mercury], 
remarks — few  cumulus  cirrus. 


A  PIT  special  weather  observation  taken  at  1932  stated: 

sky  condition — clear,  visibility — 15  miles,  wind — 240°  at  6  knots,  altimeter  setting — 
30.10  inches  Hg;  remarks — ^few  cumulus  cirrus. 

The  PIT  hourly  weather  observation  taken  at  1952  stated: 

sky  condition — clear,  visibility — 15  miles,  temperature — 69°  F,  dew  point — 54°  F, 
wind — 240°  at  5  knots,  altimeter  setting — 30.10  inches  Hg. 


Trimming  is  the  machine  grinding  of  the  outside  diameter/groove  interface  that  forms  the  metering 
edges  for  the  primary  and  secondary  slides.  Trimming  moves  the  metering  edges  to  new  longitudinal 
positions  to  better  align  the  metering  edges  with  the  metering  ports  to  meet  functional  test  requirements. 

The  qualification  testing  involved  functional  and  environmental  testing  (including  pressure,  vibration, 
and  thermal  testing)  under  conditions  that  replicated  assumed  operating  conditions  (based  on  Boeing’s 
analyses).  The  redesigned  servo  valve  being  retrofitted  on  earlier  737  series  airplanes  and  installed  on  the 
737-NG  series  airplanes  (see  section  1.18.5)  also  underwent  qualification  testing,  and  those  tests  included 
conditions  that  exceeded  the  assumed  operating  conditions  (including  thermal  conditions  that  simulated  an 
overheated  hydraulic  system)  to  evaluate  the  component’s  functional  limits. 
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The  PIT  Weather  Service  Forecast  Office  (WSFO)  is  located  about  2  miles  north- 
northwest  of  PIT  and  about  6  miles  southeast  of  the  accident  site.  A  Weather  Surveillance 
Radar-88  Doppler  (WSR-88D)  is  installed  at  that  location.  (At  the  time  of  the  accident,  the 
WSR-88D  was  operational  but  had  not  been  officially  commissioned.)  The  WSR-88D 
base  reflectivity  products^"^  provided  to  the  WSFO  for  the  times  of  1859  and  1905 
indicated  random  radar  returns  in  the  PIT  area.  According  to  PIT  WSFO  personnel,  those 
returns  were  consistent  with  the  local  ground  clutter  pattern  around  the  radar.  No  primary 
radar  returns  were  noted  in  the  vicinity  of  the  accident  airplane.  Some  witnesses  reported 
that  they  observed  large  flocks  of  migrating  birds  and  geese  in  the  area  the  afternoon  and 
evening  before  the  accident.  However,  radar  data  revealed  no  evidence  of  such  activity  in 
the  vicinity  of  the  accident  site  at  the  time  of  the  accident. 

According  to  measurements  transmitted  by  a  radiosonde  balloon^^  launched  by  the 
PIT  WSFO  at  1914,  the  winds  near  6,000  feet  msl  were  from  274°  at  15  knots,  and  the 
temperature  at  that  altitude  was  about  47°  F.  The  wind  gust  recorder  at  PIT  indicated  that 
wind  speeds  at  the  surface  varied  from  6  to  8  knots  between  1840  to  1940.  (Wind  directions 
were  not  recorded  by  the  wind  gust  recorder.) 

According  to  sunrise  and  sunset  tables,  on  September  8, 1994,  at  1903  at  the  accident 
location,  the  altitude  of  the  sun  above  the  horizon  was  approximately  7.9°.  The  magnetic 
bearing  from  the  accident  location  to  the  sun  was  about  278.7  .  Sunset  at  6,000  feet  occurred 
about  1949. 

During  postaccident  interviews,  witnesses  on  the  ground  reported  that  the  weather 
was  clear  and  sunny  at  the  time  of  the  accident,  and  the  winds  were  calm  near  the  accident 
site.  Pilots  of  other  airplanes  that  were  operating  in  the  vicinity  of  PIT  about  the  time  of 
the  accident  were  also  interviewed.  They  reported  that  the  sky  was  clear  with  unlimited 
visibility  and  that  the  air  was  smooth  with  light  winds  and  no  turbulence.  The  captain  of 
Delta  flight  1083,  which  was  sequenced  ahead  of  the  accident  flight  on  the  approach, 
stated  that  the  horizon  was  clearly  defined  and  that  visibility  was  not  restricted. 

1 .8  Aids  to  Navigation 

No  difficulties  with  the  navigational  aids  were  known  or  reported. 

1.9  Communications 

No  difficulties  with  communications  were  known  or  reported. 


^  Base  reflectivity  products  display  weather  echo  intensity  and  are  used  to  detect  precipitation. 

A  radiosonde  balloon  is  an  instrument  used  for  the  simultaneous  measurement  and  transmission  of 
meteorological  data.  The  PIT  WSFO  launches  two  radiosonde  balloons  about  0700  and  1900  every  day. 
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1.10  Airport  Information 

PIT  is  located  15  miles  northwest  of  the  city  of  Pittsburgh.  The  airport  elevation  is 
1,203  feet.  The  airport  has  four  runways.  Flight  427  was  scheduled  to  land  on  runway 
28R,  which  is  10,502  feet  long  and  150  feet  wide.  No  significant  Notices  to  Airmen  were 
in  effect  for  PIT  during  the  time  period  in  which  USAir  flight  427  was  estimated  to  arrive. 

1.11  Flight  Recorders 

The  two  flight  recorders  installed  on  the  accident  airplane  were  removed  from  the 
wreckage  and  sent  to  the  Safety  Board’s  laboratory  in  Washington,  D.C.,  for  readout. 

1.11.1  Cockpit  Voice  Recorder 

The  CVR  installed  on  the  accident  airplane  was  a  Fairchild  model  A-IOOA.^^  The 
CVR  recording  consisted  of  four  channels  of  audio  information:  the  cockpit  area 
microphone  (CAM),  the  captain  position,  the  first  officer  position,  and  the  jumpseat/ 
observer  position. Although  the  CVR  unit  showed  evidence  of  external  and  internal 
structural  damage,  the  recording  medium  (magnetic  tape)  was  in  good  condition,  and  the 
quality  of  the  recording  was  excellent.^^  A  transcript  was  prepared  of  the  entire  30-minute 
56-second  recording.  A  copy  of  the  CVR  transcript  appears  in  appendix  B. 

1.11.2  Flight  Data  Recorder 

The  FDR  was  a  Loral/Fairchild  Data  Systems  model  FIOOO  (S/N  442),  which 
recorded  13  parameters'^  of  airplane  flight  information  using  solid-state  nonvolatile  flash 
memory  as  the  recording  medium.  Although  the  FDR  exhibited  external  and  internal 
impact  damage,  the  crash-protected  memory  module  unit  and  recording  medium  were 


^  The  CVR  identification  plate  and  S/N  were  missing;  however,  USAir  maintenance  records  indicate 
that  the  CVR  on  the  accident  airplane  was  S/N  5061. 

The  audio  obtained  from  the  jumpseat/observer  channel  was  of  a  lower  intensity  and  sounded  more 
“hollow”  than  that  obtained  from  the  CAM.  Further  investigation  revealed  that  similar  audio  information 
was  obtained  in  a  737  airplane  in  which  the  microphone  selector  switch  at  the  jumpseat/observer  position 
was  left  in  the  oxygen  mask  position  and  the  oxygen  mask  was  stowed  correctly  in  its  formed  plastic  sleeve. 

The  Safety  Board  uses  the  following  categories  to  classify  the  levels  of  CVR  recording  quality: 
excellent,  good,  fair,  poor,  and  unusable.  An  excellent  recording  is  one  in  which  virtually  all  of  the  crew 
conversations  can  be  accurately  and  easily  understood.  The  transcript  that  is  developed  from  the  recording 
may  indicate  only  one  or  two  words  that  were  not  intelligible,  usually  because  of  simultaneous  cockpit/radio 
transmissions  that  obscured  each  other. 

Title  14  CFR  Section  121.343  required  that,  by  May  26,  1995,  large  airplanes  type  certificated  before 
October  1,  1969  (which  included  the  accident  airplane),  be  equipped  with  FDRs  that  record  11  parameters. 
The  regulations  also  required  that  airplanes  type  certificated  after  October  1,  1969,  and  airplanes 
manufactured  after  May  26,  1989,  be  equipped  with  FDRs  that  record  17  parameters.  Additionally,  the 
regulations  required  that  airplanes  manufactured  after  October  11,  1991,  be  equipped  with  FDRs  that  record 
31  parameters.  Even  though  the  accident  airplane’s  FDR  recorded  13  parameters,  it  has  often  been  referred 
to  as  an  11-parameter  recorder  because  it  was  not  required  by  14  CFR  Section  121.343  to  record  the  engine 
EOT  and  fuel  flow  parameters. 
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intact  and  yielded  good  data.  Recorded  parameters  that  were  sampled  at  once-per-second 
intervals  were  altitude,  indicated  airspeed,  heading,  microphone  keying,  exhaust  gas 
temperature  (EGT,  both  engines),  fuel  flow  (both  engines),  compressor  speed  (N2, 
measured  as  a  percentage,  for  both  engines),  and  fan  speed  (Nl,  measured  as  a  percentage, 
for  both  engines).  Recorded  parameters  that  were  sampled  at  more  frequent  rates  were  roll 
attitude  and  control  column  position  (two  times  per  second),  pitch  attitude  and 
longitudinal  acceleration  (four  times  per  second),  and  vertical  acceleration  (eight  times  per 
second).  The  FDR  did  not  record  data  regarding  the  flight  control  surface  positions,  and 
Federal  regulations  (14  CFR  Section  121.343)  did  not  include  a  requirement  to  record 
such  data.  (See  section  1.18.11.4  for  information  about  Safety  Board  recommendations 
regarding  FDRs.) 

1.12  Wreckage  and  Impact  Information 

1.12.1  On-Site  Examination 

The  on-site  phase  of  the  investigation,  including  examination,  documentation, 
decontamination,  and  recovery  of  the  wreckage,  occurred  between  September  9  and 
September  20, 1994. 

The  accident  airplane’s  primary  impact  point  was  in  a  densely  wooded  area  on  an 
up-sloping  hillside  on  the  south  side  of  a  dirt  road  that  was  oriented  southwest/northeast  and 
accessed  three  houses.  The  airplane  wreckage  was  severely  fragmented,  crushed,  and 
burned,  and  some  sections  had  been  destroyed  or  nearly  destroyed  by  fire.  Because  some 
portions  of  the  wreckage  were  not  visible  above  the  ground,  investigative  personnel  used 
ground-penetrating  radar  (GPR)  to  locate  and  recover  additional  pieces  of  the  wreckage. 
(See  section  1.19  for  details  about  the  use  of  GPR.)  Some  pieces  of  wreckage  were 
excavated  from  the  hillside  at  depths  of  up  to  8  feet.  Most  of  the  airplane  wreckage, 
including  all  flight  controls  and  major  components,  was  located  within  a  350-foot  radius  of 
the  main  impact  crater. 

The  left  wing  and  the  No.  1  engine,  which  were  located  south  of  the  access  road 
and  east  of  the  main  impact  crater,  exhibited  severe  impact  and  postimpact  fire  damage. 
The  No.  1  engine  was  separated  from  the  left  wing  and  partially  covered  by  burned  left 
wing  skin  and  spar  materials.  A  ground  scar,  about  25  feet  in  length,  extended  in  an 
easterly  direction  from  the  No.  1  engine  and  left  wing  wreckage  on  an  up-sloping  hill.  The 
outboard  end  of  the  ground  scar  contained  several  small  pieces  of  red  glass,  and  portions 
of  the  left  wing  tip  were  located  nearby.  Trees  located  near  the  ground  scar  and  the  left 
wing  had  broken  limbs  and  branches. 

The  right  wing,  which  was  located  along  the  northern  edge  of  the  access  road 
about  40  feet  west  of  the  main  impact  crater,  also  exhibited  severe  impact  damage.  The 
No.  2  engine  was  separated  from  the  right  wing  and  located  along  the  northern  edge  of  the 
access  road  about  30  feet  west  of  the  main  impact  crater.  Sections  of  the  right  wing  were 
found  on  the  north  side  of  the  access  road  and  the  adjacent  hillside,  and  the  inboard  section 
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of  the  wing  was  facing  in  the  northeast  direction.  The  remaining  leading  edges  of  both 
wings  were  crushed  in  an  aft  and  up  direction. 

Examination  of  the  spoiler  control  surfaces  and  actuators  revealed  that  the  four  wing 
spoilers  were  located  in  the  retracted  position  at  impact  with  no  evidence  of  preimpact 
failure.  Examination  of  the  Krueger  (leading  edge)  flaps  and  leading  edge  slats  indicated  that 
they  were  extended  symmetrically  at  impact  with  no  evidence  of  preimpact  failure  of  the 
flaps;  slats;  and  their  attachments,  rollers,  or  tracks.™  The  trailing  edge  flaps  were  in  a 
partially  extended  symmetrical  position.  Jackscrew  and  hydraulic  actuator  measurements 
indicated  that  the  leading  and  trailing  edge  devices  were  positioned  consistent  with  a  flaps  1 
setting.  The  trailing  edge  flaps  exhibited  compression  damage  and  postimpact  fire  damage. 
No  evidence  was  found  of  structural  fatigue  or  preimpact  fire  on  the  trailing  edge  flaps  or 
flap  tracks.  The  wing  spoilers  were  fractured  and  exhibited  fire  damage.  The  landing  gear 
were  found  in  the  retracted  position. 

Both  engines  were  found  fragmented,  burned,  and  separated  from  their  respective 
pylons.  The  pylons,  nacelles,  and  thrust  reverser  components  from  both  engines  were 
fragmented  and  scattered  around  the  impact  crater.  Examination  of  the  engines,  nacelles,  and 
pylons  revealed  damage  that  was  consistent  with  engine  low-  and  high-  pressure  rotors 
rotating  at  impact.’ ' 

Fragments  of  engine  thrust  reverser  components  (including  the  cascades,  hinges, 
latches,  cowls,  and  bulkhead)  and  the  12  thrust  reverser  actuators™  were  located,  identified, 
and  examined.  All  thrust  reverser  components  exhibited  damage  consistent  with  ground 
impact  and  exposure  to  heat.  Examination  of  the  thrust  reverser  actuators  indicated  that  the 
left  engine  thrust  reverser  locking  actuators  were  in  the  stowed  position  at  impact;  however, 
the  right  engine  thrust  reverser  locking  actuators  were  discovered  in  the  extended  position. 
(Three  of  the  four  left  engine  nonlocking  thrust  reverser  actuators  and  all  four  right  engine 
nonlocking  thrust  reverser  actuators  were  in  the  stowed  position.)  The  four  locking  thrust 
reverser  actuators  were  removed  from  the  main  wreckage  for  further  inspection  and 
disassembly.  Subsequent  x-ray  inspection  and  disassembly  of  the  four  thrust  reverser 
locking  actuators  indicated  that  all  four  locking  actuator  pistons  were  in  the  stowed  position, 
with  locking  keys  engaged,  at  impact. 

The  airplane’s  tail  section  was  located  in  an  inverted  position  near  the  north  edge 
of  the  access  road,  about  20  feet  west  of  the  left  wing.  The  horizontal  stabilizers  and 
elevators  remained  attached  to  the  tail  section.  The  outboard  trailing  edge  of  the  right 


™  Because  of  unusual  damage  observed  on  the  inboard  hinge  of  the  No.  1  slat,  the  Safety  Board 
conducted  ultraviolet  light  and  metallurgical  inspections  of  components  of  the  slat  track.  For  additional 
information  regarding  these  inspections,  see  section  1.12.3. 

FDR  data  indicated  that  the  engines  were  operating  normally  and  symmetrically  until  ground  impact. 
However,  the  CVR  and  physical  evidence  indicated  that  the  auxiliary  power  unit  (APU)  was  not  operating 
up  to  ground  impact. 

Six  thrust  reverser  actuators,  two  locking  and  four  nonlocking,  were  located  on  each  of  the  two 
engines.  The  locking  actuators  are  designed  to  prevent  thrust  reverser  deployment  without  the  application  of 
hydraulic  pressure. 
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horizontal  stabilizer  and  the  right  elevator  exhibited  heat,  smoke,  and  soot  damage 
patterns  consistent  with  postimpact  fire.  The  outboard  5  feet  of  the  leading  edge  of  the  left 
horizontal  stabilizer  was  destroyed.  The  inboard  7  feet  of  the  left  horizontal  stabilizer, 
adjacent  to  the  auxiliary  power  unit  (APU)  access  door,  was  crushed  5  feet  in  the  aft 
direction,  exposing  the  internal  spars  and  ribs.  Both  elevators  were  attached  at  their 
respective  horizontal  stabilizers,  and  flight  control  continuity  was  established  within  the 
tail  section.  The  elevator  tab  rods  were  connected  and  operated  properly  (that  is,  elevator 
"up'Vtab  "down,"  and  vice  versa).  Both  elevator  balance  weights  were  attached,  and  the 
elevator  neutral  shift  rods  were  attached  to  the  stabilizer  and  the  elevator  centering  unit. 
The  elevators  were  positioned  about  14°  trailing  edge  up,  and  the  horizontal  stabilizer  was 
in  an  intermediate  position. 

The  vertical  stabilizer  and  rudder  were  located  adjacent  to  the  tail  section.  The 
vertical  stabilizer  was  resting  on  its  left  side  with  the  lower  portion  of  the  vertical  fin 
adjacent  to  the  horizontal  stabilizer.  The  leading  edge  of  the  vertical  stabilizer  skin  was 
destroyed,  and  the  exposed  vertical  webs  were  crushed  in  the  upward  and  aft  direction.  The 
vertical  stabilizer  aft  of  the  rear  spar  sustained  fire  damage,  and  an  11-  by  4-foot  area,  about 
6'/2  feet  from  the  base  of  the  vertical  stabilizer,  was  consumed  by  fire.  The  rudder  had  a 
10-foot,  3-inch  area,  about  61/2  feet  from  the  base  of  the  rudder  hinge,  of  burned  and 
missing  structure.  A  bend  in  the  PCU  actuator  rod  was  consistent  with  a  rudder  position  of 
about  2°  to  the  right  (airplane  nose  right). 

The  cockpit,  which  was  found  approximately  45  feet  south  of  the  main  impact  crater, 
was  severely  fragmented.  The  identified  sections  of  the  cockpit  and  the  forward  portion  of 
the  fuselage  exhibited  compression  damage,  deformation  along  the  airplane's  longitudinal 
axis,  and  some  postimpact  fire  damage.  Although  sections  of  the  seat  tracks  for  both  pilots 
were  identified,  it  was  not  possible  to  determine  either  seat  position  at  impact.’^  The  left 
rudder  pedal  shafts  were  sheared  at  both  pilot  positions;  both  right  rudder  pedals  exhibited 
bending  but  were  not  sheared.’'^  Cockpit  instrumentation  and  switches  that  were  identified 
included  a  radio  magnetic  indicator,  two  airspeed  indicator  digital  displays,  the  autopilot 
MCP,  ground  proximity  warning  system  (GPWS)  switch,  and  an  FD  switch.  The  radio 
magnetic  indicator  showed  212°,  the  airspeed  displays  indicated  264  knots,  and  the  GPWS 
and  FD  switches  were  in  the  “on”  position;  damage  to  the  autopilot  MCP  precluded  a 
determination  of  the  preimpact  mode  selections. 

A  ground  and  helicopter  search  for  additional  airplane  components  was  conducted 
during  the  on-site  phase  of  the  investigation,  but  no  additional  components  were  found. 
Several  light-weight  items  (for  example,  pieces  of  interior  insulation  and  a  passenger 
business  card)  were  discovered  as  far  as  l}/2  miles  east-northeast  of  the  main  wreckage, 
these  items  exhibited  soot  and  smoke  damage.  One  witness  stated  that  he  heard  the  sound 
of  the  crash  while  he  was  playing  golf  about  2  miles  east-northeast  of  the  accident  site, 
about  2  minutes  later,  he  observed  blackened  insulation  falling  onto  the  golf  course.  The 
insulation,  business  card,  and  sections  of  the  airplane’s  cargo  liner  were  sent  to 


Pilot  seat  position  is  discussed  further  in  section  1.18.8. 

The  rudder  pedal  assemblies  were  retained  for  further  examination,  as  described  in  section  1.16.5.1. 
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Safety  Board  and  Federal  Bureau  of  Investigation  (FBI)  laboratories  for  examination, 
which  revealed  no  evidence  of  explosive  residue. 

Before  removal  from  the  accident  site,  the  wreckage  was  thoroughly  examined, 
components  were  identified  and  photographed,  and  critical  measurements  were  recorded. 
Also,  fire  and  explosives  experts  examined  pieces  of  the  wreckage  for  evidence  of 
preimpact  fire  and/or  explosion,  and  no  such  evidence  was  found.  After  the  airplane 
wreckage  was  documented  and  decontaminated,  it  was  relocated  from  the  accident  site  to 
a  hangar  facility  at  PIT  for  further  examination  and  a  two-dimensional  reconstruction. 
Except  for  certain  components  and  control  cables  that  were  retained  for  further 
examination,’^  the  airplane  wreckage  was  released  to  USAir  on  April  3, 1995. 

1.12.2  Reconstruction  Examination 

Between  October  30  and  November  11,  1994,  the  Safety  Board  conducted  a  two- 
dimensional  reconstruction  of  the  wings  and  the  fuselage,  including  the  forward  pressure 
bulkhead,  floor  beams,  wheels  and  tires,  wheel  wells,  auxiliary  fuel  tank,  and  roll  control 
cables.  The  reconstruction  was  accomplished  to  determine  whether  a  control  cable  failure, 
bird  (or  other  airborne  object)  strike,  floor  beam  failure,  or  in-flight  explosion  were 
involved  in  the  accident. 

Because  of  its  experience  in  reconstructing  the  Boeing  747  airplane  involved  in  the 
Pan  American  World  Airways  flight  103  in-flight  explosion  and  crash  that  occurred  near 
Lockerbie,  Scotland,’^  the  Air  Accidents  Investigation  Branch  (AAIB)  of  Famborough, 
England,  was  asked  to  and  did  participate  in  the  effort  to  reconstruct  the  USAir  flight  427 
accident  airplane.  The  AAIB  representatives  stated  that  the  destruction  and  fire  damage 
(which  they  considered  “extreme  for  that  associated  with  civil  aircraft  accidents”) 
complicated  efforts  to  identify  components  and  reconstruct  the  airplane.  Despite  the 
complications,  the  AAIB  found  no  evidence  of  any  preimpact  explosion.  The  wreckage  was 
further  examined  by  explosion  experts  from  the  FAA  and  the  FBI,  and  they  also  found  no 
evidence  of  any  preimpact  explosion. 

With  the  use  of  Boeing  drawings.  Safety  Board  investigators  identified  pieces  of 
the  fuselage  and  wings,  and  the  pieces  were  positioned  on  the  hangar  floor  according  to 
their  structural  station  locations.  Numerous  pieces  of  the  lower  forward  fuselage  and 
sections  of  the  wing  were  too  small,  fragmented,  or  severely  damaged  by  postimpact  fire 
to  be  identified.  The  lateral  and  longitudinal  floor  beam  structures  were  severely 
fragmented.  The  amount  of  identifiable  lateral  floor  beam  structure  varied  at  each  fuselage 
station,  with  a  minimum  of  5  percent  identified  forward  of  the  center  wing  section  and  a 
maximum  of  about  95  percent  identified  at  the  rear  galley/lavatory.  Overall,  about 
50  percent  of  the  floor  beams  (lateral  and  longitudinal,  forward  and  aft)  were  recovered 
and  identified  for  use  in  the  reconstruction. 


For  additional  information  on  the  retained  items,  see  section  1.12.2.1. 

See  Air  Accidents  Investigation  Branch.  1990.  “Report  on  the  accident  to  Boeing  747-121,  N739PA, 
at  Lockerbie,  Dumfriesshire,  Scotland  on  21  December  1988.  ”  Aircraft  Accident  Report  2/90. 
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No  sections  of  the  forward  galley  or  the  forward  lavatory  floor  structure  were 
identified.  The  aft  galley  floor  panel  was  charred,  and  the  attached  seat  tracks  exhibited 
fire  and  heat  damage;  however,  the  floor  beams  that  supported  the  aft  galley  exhibited  no 
signs  of  fire  or  heat  damage.  The  floor  of  the  lavatory  in  the  aft  cabin  was  charred,  and  the 
attached  forward  and  aft  floor  beams  displayed  evidence  of  peeled  paint  and  sooting. 

The  identifiable  sections  of  passenger  cabin  and  cockpit  structure  exhibited  no 
evidence  of  streaking  or  bums  that  would  be  consistent  with  preimpact  fire  or  explosion. 
No  evidence  of  streaking  or  bumed/sooted  structure  was  found  on  the  interior  or  exterior 
surfaces  of  cabin  and  cockpit  materials. 

Portions  of  all  of  the  doors  and  their  respective  frames  were  identified  and 
documented.  These  doors  included  the  forward  entry,  forward  service,  aft  entry,  aft  galley 
service,  forward  cargo,  rear  cargo,  lower  nose  compartment  access,  electrical/electronic 
compartment  (E/E  bay),  overwing  emergency  exit,  and  APU  service  doors.  The  majority 
of  structure  identified  in  the  forward  fuselage  was  located  near  the  fuselage  doorways.  The 
doors  forward  of  the  wing  were  the  most  severely  fragmented.  The  examination  of  the 
remains  of  the  doors,  door  frames,  and  locking  mechanisms  revealed  witness  marks  and 
other  evidence  that  was  consistent  with  all  of  the  doors  being  in  the  closed  position  at 
impact. 

The  wing  center  section  and  the  main  landing  gear  wheel  wells  were  severely 
fragmented  and  exhibited  minimal  fire  damage.  Approximately  60  percent  of  the  center 
section  wing  structure  was  positively  identified.  Examination  of  the  reconstruction 
confirmed  that  the  landing  gear  were  in  the  retracted  position  at  impact.  No  evidence  of 
preimpact  failures  or  fire  in  the  wheel  wells  before  impact  was  found.  The  examination  of 
the  tires  and  wheels  revealed  no  evidence  of  a  tire  explosion  or  fire  damage  before  impact. 

1.12.2.1  Flight  Control  System  Components 

During  the  wreckage  reconstruction,  flight  control  system  components  were 
examined  and  separated  by  location  and  system  function.  The  following  flight  control 
system  items  were  removed  from  the  wreckage  for  further  examination:  the  main  rudder 
PCU,  standby  rudder  PCU,  rudder  trim  actuator,  rudder  feel  and  centering  unit,  aileron 
PCUs,  spoiler  mixer  and  ratio  changer,  flight  and  ground  spoiler  actuators,  slat  control 
valve,  autopilot  servos,  various  autopilot  electrical  relays,  both  pilots’  rudder  pedal  and 
control  yoke  systems,  and  most  of  the  control  cables.  In  addition,  hydraulic  fluid  samples 
were  obtained  from  various  locations  in  the  accident  airplane’s  hydraulic  systems  for 
laboratory  evaluation  and  analysis.  (See  section  1.16.5.4.3  for  further  information.) 

The  aft  rudder  control  quadrant  was  found  attached  to  its  mounting  bracket  and 
separated  from  the  vertical  stabilizer.  The  aft  rudder  control  quadrant  input  rod,  the  main 
rudder  PCU  input  rod,  and  the  lower  end  of  the  rudder  torque  tube  (see  figures  6  and  6a) 
were  fractured,  and  the  cable  attach  points  were  separated  from  the  quadrant  on  each  end. 
The  upper  portion  of  the  tower  shaft  was  located  at  the  vertical  fin  with  the  main  and 
standby  rudder  PCUs  attached.  The  input  rod  for  the  standby  PCU  remained  attached  with 
no  signs  of  damage  or  binding. 
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The  broken  ends  of  all  identified  flight  control  cables,  and  several  unidentified 
cable  sections,  were  inspected  at  10-power  magnification  to  determine  their  mode  of 
failure.  The  examination  revealed  no  evidence  of  preimpact  cable  failure.  Measurements 
of  the  broken  aileron  cable  sections  and  pulley  positions  indicated  a  right  control  wheel 
input  at  impact. 

Safety  Board  investigators  identified  about  60  percent  of  the  rudder  control  cable 
length  for  the  right-side  cable  and  about  20  percent  of  the  rudder  control  cable  length  for 
the  left-side  cable.  Both  right-  and  left-side  cables  were  kinked  about  every  20  inches  (the 
approximate  distance  between  floor  beam  locations),  and  both  cables  exhibited  multiple 
breaks  at  the  tumbuckle  locations.  Some  recovered  and  identified  cables  were  sent  to  the 
Safety  Board  materials  laboratory  for  metallurgical  examination,  which  revealed  that  the 
cable  breaks  resulted  from  tensile  overload.  No  evidence  of  preimpact  failure  of  the  rudder 
cables  was  found. 

1.12.2.2  Examination/Reconstruction  of  Cargo  Compartments 

Identified  sections  of  the  forward  and  aft  cargo  compartments  were  examined  for 
evidence  of  preimpact  fire  or  explosion.  One  section  of  aluminum  flooring  from  the 
forward  cargo  compartment  exhibited  sooting  on  the  lower  side,  but  no  evidence  of  fire, 
heat,  or  soot  damage  was  found  on  the  upper  (inner)  floor  surface.  Neither  of  the  two 
cargo  compartment  pressure  relief/emergency  access  panels  (which  form  a  section  of  the 
cargo  compartment  ceiling  liner  in  the  forward  and  aft  compartments)  displayed  fire 
damage  on  either  side.  No  evidence  of  fire  damage  or  soot  was  found  on  either  the  aft 
cargo  door  or  the  recovered  pieces  of  the  forward  cargo  door.  In  addition,  the  forward 
outflow  valve  showed  no  evidence  of  soot  deposits.  Pieces  of  cargo  compartment  liner 
exhibited  evidence  of  smoke  and  fire  damage  that  was  consistent  with  a  postimpact  fire. 

1 .12.2.3  Examination/Reconstruction  of  the  Auxiliary  Fuel  Tank 

Safety  Board  investigators  examined  the  recovered  pieces  of  the  auxiliary  fuel 
tank  system  for  evidence  of  preimpact  fire,  explosion,  corrosion,  or  structural  failure. 
Investigators  identified  about  85  percent  of  the  auxiliary  tank  fuel  control  valve  box 
components  and  fuel  transfer/vent  hoses  and  fittings,  about  50  percent  of  the  electrical 
control  box  components,  and  about  40  percent  of  the  auxiliary  fuel  tank  structure.  The 
identified  sections  of  the  auxiliary  fuel  tank  included  portions  of  the  upper  panel 
(including  a  5-inch  portion  of  the  forward  upper  seam),  the  center  and  lower  portions  of 
the  forward  panel,  center  and  lower  portions  of  the  aft  panel,  side  angle  panels,  and  sump 
drain  doubler  from  the  lower  panel.  The  compression  beams  located  at  the  aft  pressure 
bulkhead  were  the  only  pieces  of  auxiliary  fuel  tank  support  structure  that  were  identified. 
Although  a  small  section  of  the  forward  tank  panel  displayed  fire  damage,  identified 
mating  sections  of  the  tank  structure  contained  no  evidence  of  heat  or  fire  damage.  Further 
examination  of  the  auxiliary  fuel  tank  panels  and  support  structure  revealed  no  additional 
evidence  of  heat  or  fire  damage. 

The  auxiliary  fuel  tank  components  (valves,  screens,  filters,  and  motors)  did  not 
exhibit  any  abnormal  characteristics,  and  the  auxiliary  fuel  tank  valve  positions  were 
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consistent  with  a  deactivated  fuel  tank.’’  The  auxiliary  fuel  tank  pressure  relief  valve  was 
found  intact.  Postaccident  pressure  and  leak  tests  revealed  that  the  relief  valve  opened  at 
9  psi;  the  valve  is  designed  to  open  at  10  ±  1  psi.  The  bleed  air  filter  exhibited  no  evidence 
of  internal  or  external  contamination  and  no  odor  of  fuel. 

Examination  of  the  identified  fuel  lines  and  hoses  revealed  varying  amounts  of 
heat  and  fire  damage.  For  example,  the  portion  of  steel  braid-covered  fuel  hose  that 
extended  forward  from  the  auxiliary  fuel  tank  to  the  bulkhead  at  body  station  727  showed 
no  evidence  of  heat  or  fire  damage.  However,  the  steel  braid-covered  fuel  hose  that 
extended  forward  from  the  body  station  727  bulkhead  to  the  wing  center  section  exhibited 
severe  heat  and  fire  damage;  only  the  end  fittings  and  steel  braid  remained  intact.  One 
portion  of  the  wing  center  section  structure,  installed  4  feet  away  from  the  charred  portion, 
exhibited  severe  charring;  however,  the  center  section  structure  exhibited  no  evidence  of 
heat  or  fire  damage.  The  fuel  hose  assembly  contained  in  the  airplane’s  center  fuel  tank 
exhibited  heat  exposure  and  burned  hose  rubber;  however,  the  crossfeed  line  (external  to 
the  center  fuel  tank)  was  not  charred. 

1.12.3  Examination  of  Wreckage  for  Indications 
of  Possible  Bird  Strike 

Because  of  witness  reports  that  large  flocks  of  migratory  birds  were  observed  in 
the  Pittsburgh  area  throughout  the  afternoon  and  evening  of  the  accident,’®  the  Safety 
Board  examined  the  wreckage  for  indications  of  a  possible  bird  strike.  Ultraviolet  light,  a 
method  commonly  used  for  detecting  blood,’^  was  used  to  examine  several  pieces  of  the 
radome,  portions  of  the  forward  pressure  bulkhead,  left  wing  slats,  cockpit  flight  control 
components,  and  leading  edges  of  the  vertical  and  horizontal  stabilizers  for  bird  remains. 

Although  no  evidence  of  bird  stains,  remains,  or  other  organic  matter  was  found  on 
most  of  the  examined  areas,  investigators  noted  a  small  (10-  by  5-inch  chordwise)  stain  on 
the  outer  surface  of  the  outboard  No.  1  slat.  A  3-  by  5-inch  section  of  the  stain,  located  in 
the  upper  external  portion  aft  of  the  leading  edge  of  the  slat  and  oriented  in  a  spanwise 
direction,  exhibited  a  more  intense  white  fluorescence  when  illuminated  by  ultraviolet 
light.  The  stained  area  was  adjacent  to  fractured  segments  of  the  No.  1  outboard  slat  track. 
Two  small  samples  of  the  fluorescent  debris  were  removed  from  the  slat  surface  and  the 
adjacent  interior  slat  cavity.  The  samples  were  examined  by  an  ornithologist  at  the 


’’  According  to  USAir’s  maintenance  procedures,  after  auxiliary  fuel  tank  deactivation,  the  fuel  transfer 
valve  and  the  fuel  fill  valve  should  be  in  the  closed  position,  with  the  fuel  fill  valve  circuit  breaker  in  the 
cockpit  pulled  and  collared  to  ensure  that  the  valve  remains  closed  (unless  intentionally  reactivated).  The 
auxiliary  fuel  tank  bleed  air  circuit  breaker  (which  controls  the  bleed  air  solenoid  valve)  is  also  pulled  during 
the  deactivation  process.  The  fuel  fill  valve  and  auxiliary  fuel  tank  bleed  air  circuit  breakers  were  not  located 
in  the  wreckage. 

No  such  observations  were  reported  in  official  weather  observations,  by  pilots  of  other  airplanes  in  the 
area,  or  in  WSR-88D  data. 

”  According  to  an  Armed  Forces  Institute  of  Pathology  (AFIP)  laboratory  report  on  its  examination  of  a 
portion  of  the  accident  airplane’s  left  wing,  biological  material  can  fluoresce  when  viewed  under  an 
ultraviolet  light  of  the  appropriate  wavelength. 
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Smithsonian  Institution’s  Associate  Division  of  Birds,  who  determined  that  the  debris 
exhibited  no  characteristics  that  resembled  those  of  a  bird. 

The  outboard  No.  1  slat  was  also  examined  by  specialists  from  the  Armed  Forces 
Institute  of  Pathology  (AFIP).  According  to  the  AFIP  laboratory  report,  the  pieces  of 
debris  were  inspected  using  an  Omnichrome  Alternate  Light  Source  unit  (all  wavelength 
spectrums  and  all  optical  filters),  a  Luminol  solution,  and  Leucomalachite  Green  solution. 
The  AFIP  report  stated  that  none  of  the  inspection  techniques  revealed  any  luminescence 
that  would  indicate  the  presence  of  blood  or  blood-like  material  on  the  debris  pieces  but 
that  “several  type  of  fibers,  minerals  and  other  fuel  and  petroleum  products  were  present 
in  the  samples  collected  [on  scene].”  The  report  concluded  that  the  samples  examined 
contained  “no  blood  or  blood-like  products.” 

The  fractured  segments  of  the  No.  1  outboard  slat  track  that  were  adjacent  to  the 
stained  area  of  the  No.  1  slat  were  removed  from  the  wreckage  and  transported  to  the 
Safety  Board’s  materials  laboratory  for  metallurgical  examination.  The  metallurgist’s 
report  of  the  examination  stated  that  the  aileron  hinge  bracket  “was  grossly  distorted  and 
separated  approximately  at  a  roller  position.  Visual  examination  of  the  separated  arm 
revealed  features  typical  of  an  overstress  separation.  No  evidence  of  preexisting  fracture 
areas  was  noted.” 

1.13  Medical  and  Pathological  Information 

Toxicological  samples  (muscle  tissue)  from  both  pilots  were  sent  to  the  FAA’s 
Civil  Aeromedical  Institute  (CAMI)  in  Oklahoma  City,  Oklahoma,  for  examination. 
Although  ethanol  was  detected  in  muscle  tissue  samples  from  both  the  captain  (34  mg/dl, 
or  0.034  percent  weight/volume — also  known  as  blood  alcohol  content)  and  first  officer 
(54  mg/dl,  or  0.054  percent  blood  alcohol  content),  the  toxicological  reports  stated  that 
“the  delay  in  the  collection  and  the  analysis  of  specimens  may  have  resulted  in 
postmortem  ethanol  production.”  The  pilots’  toxicological  results  were  negative  for  all 
drugs  of  abuse  and  prescription  as  well  as  over-the-counter  medications. 

1.14  Fire 

An  intense  postimpact  fire  melted  localized  sections  of  the  airplane  structure  and 
scorched  nearby  trees  and  the  ground  surrounding  the  crash  site.  Fire-fighting  personnel 
and  equipment  from  Hopewell  Township  and  Beaver  and  Allegheny  Counties, 
Pennsylvania,  arrived  at  the  accident  site  within  minutes  of  the  crash,  and  firefighters 
began  efforts  to  extinguish  the  fire  immediately  after  arriving  on  the  scene.  The  fire 
burned  for  approximately  5  hours  before  it  was  extinguished  but  continued  to  smolder  for 
several  days. 
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1.15  Survival  Aspects 

Because  the  airplane  was  destroyed  and  no  occupiable  space  remained  intact,  the 
accident  was  not  survivable.  The  Beaver  County  Coroner’s  Office  investigative  report 
stated  that  all  airplane  occupants  were  killed  as  a  result  of  “blunt  force  impact  trauma. 

The  emergency  response  by  Hopewell  Township,  Beaver  County,  and  Allegheny 
County  authorities  was  initiated  after  they  received  telephone  calls  informing  them  of  the 
accident.  The  authorities  began  to  arrive  at  the  accident  site  within  minutes  after  the  crash. 

1.16  Tests  and  Research 

1.16.1  Background  Information— Other  Significant 
Yaw/Roii  Events 

Because  of  early  indications  that  the  initial  upset  of  USAir  flight  427  might  have 
been  caused  by  an  unintended  or  uncommanded  rudder  movement,  which  was  considered 
(but  not  established  as  a  cause  or  factor)  in  connection  with  the  1991  crash  of  a  737  at 
Colorado  Springs,  Colorado  (United  Airlines  flight  585),*®  the  Safety  Board  reviewed  all 
of  the  information  collected  for  the  investigation  of  that  accident  during  the  investigation 
of  the  USAir  flight  427  accident.**  In  addition,  the  Safety  Board  investigated  a  1996 
yaw/roll  incident  involving  a  737  near  Richmond,  Virginia  (Eastwind  flight  517),  to 
determine  if  the  upset  event  may  have  been  related  to  an  anomalous  rudder  movement. 
Because  much  of  the  testing  and  research  that  was  done  in  connection  with  the  USAir 
flight  427  investigation  also  incorporated  information  or  examined  components  from  the 
United  accident  and  Eastwind  incident,*^  factual  information  from  these  two  events  is 
presented  in  the  next  two  subsections. 

1 .1 6.1 .1  United  Airlines  Flight  585  Accident 

On  March  3,  1991,  United  Airlines  flight  585,  a  737-291,  N999UA,  was  rolling 
out  of  a  right  turn  to  the  north  on  the  final  approach  for  runway  35  at  Colorado  Springs 
Municipal  Airport  in  Colorado  Springs,  Colorado,  when  it  suddenly  yawed  and  then  rolled 
to  the  right,  pitched  nose  down,  and  crashed  short  of  the  runway.  The  airplane  impacted 


See  National  Transportation  Safety  Board.  1992.  United  Airlines  Flight  585,  Boeing  737-291, 
N999UA,  Uncontrolled  Collision  With  Terrain  for  Undetermined  Reasons,  4  Miles  South  of  Colorado 
Springs  Municipal  Airport,  Colorado  Springs,  Colorado,  March  3,  1991.  Aircraft  Accident  Report 
NTSB/ AAR-92/06.  Washington,  DC. 

In  addition,  one  of  the  recommendations  in  the  FAA’s  1995  Critical  Design  Review  (CDR)  report  was 
that  the  Safety  Board  begin  a  combined  investigation  of  the  United  flight  585  and  USAir  flight  427 
accidents.  (See  section  1.18.4  for  more  information  on  the  CDR  team  and  its  report.) 

For  more  information,  see,  for  example,  section  1.16.3.1  (Eastwind  Flight  517  Flight  Tests),  section 
1.16.6  (Flight  Performance  Simulation  Studies),  section  1.16.5.4  (Detailed  Examinations  and  Tests  of  Main 
Rudder  PCUs),  and  section  1.16.7.4.1  (Comparison  of  Engine  Sound  Signatures  From  United  Flight  585 
CVR  and  CVR  from  737-200  Flight  Tests). 


Factual  Information 


45 


Aircraft  Accident  Report 


the  ground  about  0943:42.*^  All  25  people  aboard  the  airplane  were  killed,  and  the 
airplane  was  destroyed  by  impact  forces  and  postcrash  fire. 

When  the  accident  sequence  began  (CVR  and  FDR  evidence  indicated  that  the 
upset  began  about  0943:32),  the  airplane  was  operating  at  160  knots  with  flaps  extended  to 
30°  and  the  landing  gear  extended.  CVR  and  meteorological  information  indicated  that  the 
pilots  of  United  flight  585  were  conducting  a  visual  approach  to  the  runway  in  moderate- 
to-severe  turbulence  and  gusty  wind  conditions;  low-level  windshear  was  reported. 

The  United  flight  585  CVR  indicated  that,  as  the  pilots  prepared  for  the  approach 
to  the  destination  airport,  they  discussed  the  strong  gusty  winds  and  windshear  conditions 
they  expected  to  encounter  during  the  approach,  airspeed  adjustments  to  compensate  for 
those  conditions,  and  missed  approach  procedures.  The  captain  was  performing  the  PF 
duties,  and  the  first  officer  was  performing  PNF  duties.  About  0938:14,  the  first  officer 
requested  information  from  ATC  regarding  pilot  reports  concerning  loss  or  gain  of 
airspeed.  About  0939:26,  when  the  airplane  was  on  a  southerly  heading  and  had  just 
passed  abeam  (and  to  the  east)  of  the  end  of  runway  35,  the  CVR  recorded  the  captain 
saying  “...we’re  not  gonna  be  in  a  rush... we  want  to  stabilize  it  out  here....”  The  first 
officer  responded,  “yeah,  I  feel  the  same  way.”  About  0940:44,  while  the  first  officer  was 
busy  completing  a  checklist,  the  captain  requested  additional  information  from  ATC 
regarding  traffic.  The  pilots  began  a  series  of  right  turns  toward  the  (northbound)  final 
approach.  They  incrementally  extended  flaps,  extended  the  landing  gear,  and 
accomplished  the  final  descent  checklist.  Figure  11  shows  a  plot  of  United  flight  585’s 
ground  track  based  on  FDR  and  radar  data. 

As  the  pilots  began  to  align  the  airplane  with  the  final  approach  course,  the 
airplane  was  experiencing  airspeed  changes  (±  10  knots)  and  rapid  heading  changes.®'^ 
About  0942:29,  0942:31,  and  0943:01,  the  CVR  recorded  the  flight  crew  stating 
information  related  to  uncommanded  airspeed  changes.  According  to  the  CVR,  the  first 
officer  said  “wow  about  0943:08”  and  “we’re  at  a  thousand  feet”  at  0943:28.2.  At 
0943:32.6,  the  CVR  recorded  the  first  officer  exclaiming  “oh  god;”  less  than  1  second 
later  (at  0943:33.5),  the  captain  stated  “fifteen  flaps,”  and  the  first  officer  responded 
“fifteen.”  The  CVR  sound  spectrum  study  indicated  that  the  sounds  before  impact  were 
consistent  with  both  engines  accelerating.®^ 

FDR  data  indicated  that  United  flight  585  began  a  sharp  heading  change  to  the 
right  and  a  sudden  descent  about  the  time  the  captain  called  for  “fifteen  flaps.”  The  CVR 
recorded  the  first  officer  stating  “oh”  at  0943:34.4  and  the  captain  exclaiming  “oh”  loudly 
at  0943:34.7.  One  second  later,  the  first  officer  and  the  captain  each  stated  “[expletive]” 


All  times  in  this  subsection  are  mountain  standard  time,  based  on  a  24-hour  clock.  The  CVR  time 
equals  FDR  time  in  seconds  plus  0941:55  (local  mountain  standard  time). 

^  The  FDR  installed  on  United  flight  585,  a  Fairchild  Digital  Flight  Recorder  Model  F800  (S/N  4016), 
directly  recorded  five  parameters.  Altitude,  indicated  airspeed,  magnetic  heading,  and  microphone  keying 
versus  time  were  recorded  at  once  per  second,  and  vertical  acceleration  was  recorded  eight  times  per  second. 
The  Safety  Board  conducted  simulation  studies  to  derive  additional  flight-related  information  from  the  FDR 
and  radar  data  (see  section  1.16.6). 
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Figure  11.  Ground  track  of  United  flight  585. 

(at  0943:35.4  and  0943:35.7,  respectively).  At  0943:36.5,  the  CVR  recorded  the  captain 
stating  “no”  very  loudly  and,  about  1  second  later,  the  first  officer  and  the  captain  stating 
“oh,  [expletive]”  (at  0943:37.5  and  0943:38.2,  respectively).  The  CVR  recorded  the  first 
officer  stating  “oh,  my  god.. .oh,  my  god....”  beginning  at  0943:38.4,  the  captain  stating 
“oh,  no,  [expletive]”  beginning  at  0943:40.5,  and  the  sound  of  impact  just  before  the  CVR 
recording  ended  at  0943:41.5. 

The  accident  airplane’s  maintenance  history  included  two  rudder-related  pilot 
writeups  during  the  week  before  the  accident.  On  February  25, 1991,  a  pilot  wrote  that  on 
departure  got  an  abnormal  input  to  rudder  that  went  away.  Pulled  yaw  damper  circuit 
breaker.”  The  noted  corrective  action  was  “replaced  yaw  damper  coupler  and  tested  per 
maintenance  manual.”  On  February  27,  1991,  a  pilot  wrote  that  “yaw  damper  abruptly 


According  to  United  Airlines  personnel,  the  command  “fifteen  flaps”  is  part  of  the  company  s  go- 
around  procedure.  Although  United’s  standard  procedure  for  a  go-around  at  the  time  of  the  accident 
included  the  statement  “go-around  thrust”  before  reducing  the  flap  setting,  no  such  statement  was  recorded 
by  the  accident  airplane’s  CVR.  Company  personnel  advised  the  Safety  Board  that  the  “fifteen  flaps 
command  would  have  no  function,  other  than  a  go-around,  at  the  United  flight  585  airplane’s  altitude  and 
configuration.  Further,  the  Safety  Board’s  report  regarding  the  United  flight  585  accident  stated,  “four  or 
five  seconds  prior  to  impact,  two  signatures  were  noted  that  are  consistent  with  two  engines  accelerating. 
These  indications  of  increasing  engine  power  are  consistent  with  an  attempted  go-around. 
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moves  rudder  occasionally  for  no  apparent  reason  on  ‘B’  actuators.  Problem  most  likely  in 
yaw  damper  coupler... unintended  rudder  input  on  climbout  at  FL250.  [Autopilot]  not  in 
use,  turned  yaw  damper  switch  OFF  and  pulled  circuit  breaker.  Two  inputs,  one  rather 
large  deflection.”  The  main  rudder  PCU  yaw  damper  transfer  valve  (see  figure  8)  was 
removed  and  replaced,  and  the  airplane  was  returned  to  service. 

The  main  rudder  PCU  from  United  flight  585  was  severely  damaged  by  ground 
impact  and  postcrash  fire.  Operational  testing  of  the  complete  PCU  was  not  possible 
because  of  fire  damage.  However,  visual  examination  of  the  servo  valve  indicated  that  the 
secondary  slide  of  the  PCU  servo  valve  was  at  its  neutral  position  during  the  postcrash 
fire. 


The  Safety  Board’s  investigation  of  the  rudder  anomaly  discovered  during  a  July 
1992  United  Airlines  ground  check  (discussed  earlier  in  section  1.6. 3. 2.1  and  further  in 
section  1.18.1.1)  revealed  that  the  737  rudder  had  the  potential  to  operate  in  a  direction 
opposite  to  that  commanded  by  the  flight  crew  if  the  main  rudder  PCU  primary  slide 
became  jammed  to  the  secondary  slide  and  pushed  the  secondary  slide  to  its  internal  stop. 
Adverse  tolerance  buildup*^  in  some  secondary  slides  and  servo  valve  housings  could 
allow  a  rudder  reversal  if  the  secondary  slide  was  forced  to  its  internal  stop.  Examination 
of  the  United  flight  585  servo  valve  indicated  that  the  buildup  of  tolerances  of  the 
secondary  slide  and  servo  valve  components  were  such  that  the  maximum  travel  of  the 
secondary  slide  (regardless  of  the  relative  position  of  the  primary  slide)  would  not  result  in 
a  reversal  of  the  rudder  surface  motion. 

Examination  of  the  standby  rudder  actuator  input  bearing  revealed  evidence  of 
metal  transfer  (also  referred  to  as  galling)^^  between  the  input  shaft  and  the  bearing. 
However,  the  examination  determined  that  the  galling  did  not  have  sufficient  contact  area 
to  result  in  binding  that  could  not  be  overcome  by  pilot  input  on  the  rudder  pedals. 
(Galling  of  the  input  bearing  of  the  standby  rudder  actuator  is  discussed  in  more  detail  in 
section  1.16.5.3.2.) 

During  its  investigation  of  the  United  flight  585  accident,  the  Safety  Board  also 
reviewed  the  performance  of  the  flight  crew.  First  officers  who  had  flown  recently  with 
the  captain  of  United  flight  585  described  his  strict  adherence  to  standard  operating 
procedures  and  conservative  approach  to  flying.  They  indicated  that  the  captain  briefed  all 
approaches  even  in  visual  conditions,  always  reported  equipment  malfunctions,  and 
discussed  deferred  maintenance  items  with  the  first  officer.  The  first  officers  also  reported 
that,  if  the  captain  had  not  previously  flown  with  a  first  officer,  he  would  observe  that  first 
officer  perform  PF  duties  during  the  first  leg  of  a  trip  sequence.  Further,  a  first  officer  who 
had  previously  flown  with  the  captain  in  gusty,  turbulent  weather  reported  during  a 


**  Adverse  tolerance  buildup  occurs  when  the  assembling  (stacking)  of  a  series  of  parts,  all  of  which  are 
individually  built  within  tolerances  (that  is,  within  an  allowable  deviation  from  a  standard),  has  an  adverse 
result. 

Galling  is  a  condition  in  which  microscopic  projections  or  asperities  bond  at  the  sliding  interface 
under  very  high  local  pressure.  The  sliding  forces  subsequently  fracture  the  bonds,  tearing  metal  from  one 
surface  and  transferring  it  to  the  other. 
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postaccident  interview  that  the  captain  had  advised  him  to  conduct  a  go  around  if 
windshear  was  encountered.  The  first  officer  stated  that  the  captain  had  indicated  that  he 
had  no  problem  with  an  early  go-around  and  had  encouraged  the  first  officer  to  conduct  a 
go-around  if  he  thought  the  approach  was  unsafe.  Regarding  the  first  officer  s 
performance,  the  captain  of  United  flight  585  had  flown  a  3-day  trip  sequence  with  the 
United  flight  585  first  officer  a  few  weeks  before  the  accident  and  had  described  her  to  a 
friend  as  “very  competent.”  According  to  the  Safety  Board  s  final  report  on  this  accident, 
“comments  on  the  CVR  indicate  that  the  pilots  were  alert  and  aggressive  throughout  the 
final  9  seconds  [of  the  accident  sequence].” 

The  Safety  Board  also  examined  the  available  information  regarding  the  weather 
conditions  present  in  the  Colorado  Springs  area  at  the  time  of  the  accident  (strong  gusty 
winds  with  the  potential  for  mountain  rotors*^  and  windshear).  Additional  expertise  in  this 
area  was  provided  by  the  National  Oceanic  and  Atmospheric  Administration  (NOAA), 
National  Center  for  Atmospheric  Research  (NCAR),  and  National  Aeronautics  and  Space 
Administration  (NASA).  The  Safety  Board’s  final  report  on  the  United  flight  585  accident 
stated  the  following: 

Normally,  intense  rotors  produce  a  distinctive  “roaring  sound.  A  person 
12  miles  north  of  COS  [Colorado  Springs  airport]  reported  a  rotor  hitting 
the  ground  about  noon.  He  was  inside  a  building  and  went  outside  to 
observe  the  rotor  after  hearing  what  he  described  as  a  roaring  sound. 
However,  there  were  no  reports  from  witnesses  to  this  accident  hearing 
such  sounds. 

Most  of  the  weather  investigation  focused  on  the  possibility  of  a  rotor  as  a 
cause  or  a  factor  in  this  accident. . . . 

While  approaching  [Colorado  Springs],  flight  585  probably  encountered 
orographically  induced  atmospheric  phenomena,  such  as  updrafts  and 
downdrafts,  gusts,  and  vertical  and  horizontal  axis  vortices.  The  most  likely 
phenomenon  that  would  cause  the  airplane  to  roll  was  a  horizontal  axis 
vortex....  It  is  possible  that  flight  585  encountered  a  strong  horizontal  axis 
vortex  that  induced  a  rolling  moment  which  exceeded  the  airplane’s  control 
capabilities,  but  the  FDR  data  is  not  consistent  with  such  an  encounter. 

[The  Safety  Board’s  review  of  FDR  data  from  airplanes  that  had  penetrated 
horizontal  axis  vortices*^  revealed  that  the  FDRs  recorded  a  transient 
altitude  increase  (pressure  decrease)  and  anomalous  airspeed  indications. 

These  were  not  observed  in  the  FDR  data  from  United  flight  585.] 

NOAA  originally  estimated,  and  NOAA  research  work  has  confirmed,  that 
a  typical  rotor  on  the  day  of  the  accident  could  have  a  rotational  velocity  of 
0.06  radians/second  (3.4  degrees  per  second)  with  a  radius  of  1,640  feet. 

The  tangential  velocity  at  the  core  radius  would  have  been  100  feet  per 
second.  Simulations  showed  that  such  a  rotor  had  little  effect  on  airplane 
control  except  that  performance  problems  could  develop  if  the  airplane 


**  A  rotor  is  an  atmospheric  disturbance  produced  by  high  winds,  often  in  combination  with 
mountainous  terrain,  and  expressed  by  a  rotation  rate  (in  radians  per  second),  a  core  radius  (in  feet),  and  a 
tangential  speed  (in  feet  per  second).  Rotation  can  occur  around  a  horizontal  or  vertical  axis.  One  radian 
equals  approximately  57°. 
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remained  in  the  downflow  field  of  the  rotor.  In  a  sustained  downflow,  the 
airplane  would  either  have  to  lose  altitude  or  airspeed,  similar  to  the 
outcome  of  entering  the  downflow  field  of  a  microburst....  The  airplane 
did  lose  altitude  at  a  higher  than  normal  rate,  but  the  airspeed  remained 
constant.... 

...It  was  determined  that  rotors  with  rotation  rates  of  0.6  radians/second 
(34  degrees  per  second)  with  a  250  feet  core  radius  (150  feet/second 
tangential  velocity)  generated  extreme  control  difficulties.... 

Wind  shears  or  gust  fronts  severe  enough  to  produce  control  difficulties 
also  produced  flight  responses  that  were  clearly  different  than  those 
recorded  on  the  accident  airplane....  Large  changes  in  heading  into  the 
wind,  large  increases  in  airspeed,  and  rapid  rolling  away  from  the  wind  if 
not  controlled  by  the  pilot —  Wind-induced  side  slip... with  marked 
increases  in  normal  acceleration  (G-load). 

On  December  8,  1992,  the  Safety  Board  adopted  the  following  probable  cause 
statement  for  the  United  flight  585  accident: 

The  National  Transportation  Safety  Board... could  not  identify  conclusive 
evidence  to  explain  the  loss  of  United  Airlines  flight  585. 

The  two  most  likely  events  that  could  have  resulted  in  a  sudden 
uncontrollable  lateral  [roll]  upset  are  a  malfunction  of  the  airplane’s  lateral 
[roll]  or  directional  control  system  or  an  encounter  with  an  unusually 
severe  atmospheric  disturbance.  Although  anomalies  were  identified  in  the 
airplane’s  rudder  control  system,  none  would  have  produced  a  rudder 
movement  that  could  not  have  been  easily  countered  by  the  airplane’s 
lateral  [roll]  controls.  The  most  likely  atmospheric  disturbance  to  produce 
an  uncontrollable  rolling  moment  was  a  rotor  (a  horizontal  axis  vortex) 
produced  by  a  combination  of  high  winds  aloft  and  the  mountainous 
terrain.  Conditions  were  conducive  to  the  formation  of  a  rotor,  and  some 
witness  observations  support  the  existence  of  a  rotor  at  or  near  the  time  and 
place  of  the  accident.  However,  too  little  is  known  about  the  characteristics 
of  such  rotors  to  conclude  decisively  whether  they  were  a  factor  in  this 
accident. 

As  a  result  of  the  United  flight  585  accident  investigation,  the  Safety  Board  made 
seven  safety  recommendations,  including  Safety  Recommendations  A-92-57  and  -58, 
which  were  issued  on  July  20, 1992.’°  These  recommendations  asked  the  FAA  to 


The  Safety  Board’s  review  of  its  accident/incident  database  revealed  that,  although  several  high- 
altitude  horizontal  axis  vortex  encounters  resulted  in  serious  injuries  (from  turbulence),  only  one  instance  of 
such  a  vortex  resulted  in  a  catastrophic  air  carrier  accident.  (See  National  Transportation  Safety  Board. 
1967.  Braniff  Airways,  Inc.,  BAC-111,  N1553,  August  6,  1966,  near  Falls  City,  Nebraska.  Washington,  DC.) 
During  the  Safety  Board’s  investigation  of  the  USAir  flight  427  accident  (and  subsequent  reexamination  of 
United  flight  585  data),  Air  Line  Pilots  Association  (ALFA)  personnel  advised  the  Safety  Board  of  a 
documented  mountain  rotor  encounter  that  occurred  on  January  29,  1993.  A  737-200  operating  as  Alaska 
Airlines  flight  66  encountered  a  mountain  rotor  while  climbing  through  900  feet  above  ground  level  (agl) 
after  takeoff  from  Juneau,  Alaska.  (For  additional  information,  see  Human  Performance  Segment  Factual 
Report,  Addendum,  November  20,  1998.) 


Factual  Information 


50 


Aircraft  Accident  Report 


Develop  and  implement  a  meteorological  program  to  observe,  document, 
and  analyze  potential  meteorological  aircraft  hazards  in  the  area  of 
Colorado  Springs,  Colorado,  with  a  focus  on  the  approach  and  departure 
paths....  This  program  should  be  made  operational  by  the  winter  of  1992. 
(A-92-57) 

Develop  a  broader  meteorological  aircraft  hazard  program  to  include  other 
airports  in  or  near  mountainous  terrain,  based  on  the  results  obtained  in  the 
Colorado  Springs,  Colorado,  area.  (A-92-58) 

In  response  to  Safety  Recommendation  A-92-57,  NOAA  and  NCAR  collected 
weather  and  wind  data  in  the  Colorado  Springs  area  between  February  and  April  1997. 
The  June  1998  NOAA/NCAR  interim  report”  indicated  that  numerous  mountain-induced 
weather  phenomena  were  observed,  including  low-altitude  windflow  reversals, 
windshears,  and  horizontal  axis  vortices  (rotors).  The  Safety  Board’s  review  of  the 
NOAA/NCAR  data  revealed  that,  in  several  cases,  the  upper  wind  directions  were  similar 
to,  but  weaker  than,  those  that  existed  in  the  Colorado  Springs  area  when  the  United  flight 
585  accident  occurred.’^  The  data  from  these  cases  showed  that  mountain  rotors  were 
present.  Some  of  the  weaker  rotors  measured  by  NOAA/NCAR  were  located  between  the 
surface  and  about  3,000  feet  above  ground  level  (agl),  whereas  other  (stronger)  rotors 
were  observed  at  altitudes  exceeding  4,000  feet  agl. 

The  rotors  observed  during  the  NOAA/NCAR  data  gathering  program  had  a 
maximum  rotational  rate  of  0.05  radians  per  second,  which  is  less  than  the  rotational  rate 
of  0.6  radians  per  second  that  was  demonstrated  during  the  investigation  of  the  United 
flight  585  accident  to  be  necessary  to  produce  extreme  control  difficulties  in  a  737 
airplane.  According  to  NOAA  scientists,  stronger  upper  windspeeds  produce 
proportionally  stronger  rotors.  Therefore,  if  the  upper  windspeeds  encountered  by  United 
flight  585  were  three  times  stronger  than  those  measured  by  NOAA/NCAR,  the  rotor 
rotational  rate  could  be  three  times  stronger.  (For  example,  a  rotor  three  times  stronger 
than  the  maximum  observed  by  NOAA/NCAR  would  have  a  maximum  rotational  rate  of 
0.15  radians  per  second.) 

In  its  January  20, 1999,  letter  to  the  FAA,  the  Safety  Board  indicated  that,  pending 
the  issuance  of  the  NOAA/NCAR  final  report.  Safety  Recommendation  A-92-57  was 
classified  “Open — Acceptable  Response.”  The  Safety  Board’s  letter  also  indicated  that, 
pending  further  information  about  a  meteorological  program  to  observe,  document, 
analyze,  and  report  meteorological  hazards  at  other  airports  in  mountainous  areas.  Safety 
Recommendation  A-92-58  was  classified  “Open — Unacceptable  Response. 


^  For  additional  information  regarding  the  seven  recommendations,  see  sections  1.18.11.1,  1.18.11.2, 
and  1.18.11.3. 

”  A  Pilot  Experiment  to  Define  Mountain-Induced  Aeronautical  Hazards  in  the  Colorado  Springs  Area: 
Project  MCAT97  (Mountain-Induced  Clear  Air  Turbulence  1997),  NOAA/NCAR,  June  1998.  As  of  March 
1999,  a  final  report  had  not  been  issued. 

^  The  Safety  Board’s  review  of  the  data  indicated  that  the  upper  winds  present  at  the  time  of  the  United 
flight  585  accident  were  about  two  to  three  times  stronger  than  those  observed  in  the  NOAA/NCAR  data. 
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Further,  in  connection  with  its  investigation  of  the  USAir  flight  427  accident,  the 
Safety  Board  reexamined  the  CVR,  FDR,  meteorological  data,  airplane  performance  data, 
and  physical  evidence  from  the  United  flight  585  accident  investigation.  As  part  of  its 
reexamination  of  airplane  performance  data,  the  Safety  Board  conducted  additional 
airplane  performance  simulation  studies  using  the  FDR  and  radar  data  (see  section 
1.16.6.2).  The  Safety  Board  also  conducted  additional  human  performance  studies  based 
on  the  FDR  and  CVR  data  from  the  United  flight  585  accident  (see  sections  1.16.8  and 
1.18.8). 

1.16.1.2  Eastwind  Airlines  Flight  517  Incident 

On  June  9,  1996,  Eastwind  Airlines  flight  517,  a  737-200,  N221US,  experienced  a 
yaw/roll  upset  about  2200  near  Richmond,  Virginia.  The  airplane  was  operating  at  an 
airspeed  of  about  250  knots  and  an  altitude  of  about  4,000  feet  msl  in  visual  flight  rules 
(VFR)  conditions  when  the  yaw/roll  event  occurred.  The  pilots  were  able  to  regain  control 
of  the  airplane  and  land  at  the  destination  airport  without  further  incident.  None  of  the  53 
airplane  occupants  were  injured,  and  no  damage  to  the  airplane  resulted  from  the  incident. 

During  postincident  interviews,  the  captain  reported  that  he  was  flying  the  airplane 
with  the  autopilot  disengaged^^  and  his  feet  resting  lightly  on  the  rudder  pedals  during  the 
descent  to  land  at  Richmond.  Both  the  captain  and  first  officer  reported  that  they  had  not 
encountered  any  turbulence  or  unusual  weather  during  the  flight,  which  originated  from 
Trenton,  New  Jersey,  or  the  approach  to  land.  However,  the  captain  said  that,  as  the 
airplane  descended  through  about  5,000  feet  msl,  he  felt  a  brief  rudder  “kick”  or  “bump” 
on  the  right  rudder  pedal  but  that  the  pedal  did  not  move.  The  captain  stated  that  he 
glanced  at  the  first  officer’s  feet  to  see  if  he  had  contacted  the  rudder  pedals  but  that  the 
first  officer  had  his  feet  flat  on  the  floor. 

FDR  information^"*  and  flight  crew  and  flight  attendant  interviews  indicated  that, 
as  the  airplane  descended  through  about  4,000  feet  msl,  the  airplane  yawed  abruptly  to  the 
right  and  then  rolled  to  the  right.  The  captain  stated  that  he  immediately  applied  “opposite 
rudder  and  stood  pretty  hard  on  the  pedal.”  The  captain  stated  that,  almost  simultaneously 
with  these  rudder  inputs,  he  applied  left  aileron.’^  Further,  the  captain  consistently 
reported  that  the  rudder  pedal  control  felt  stiffer  than  normal  and  did  not  seem  to  respond 
normally  throughout  the  upset  event.  The  first  officer  stated  that  he  saw  the  captain 


The  captain  reported  that  it  was  his  practice  to  disconnect  the  autopilot  when  descending  through 
10,000  feet  msl  and  manually  fly  the  airplane  to  landing. 

The  FDR  installed  on  the  Eastwind  flight  517  airplane,  a  Loral/Fairchild  Data  Systems  model  FIOOO 
(S/N  00948),  recorded  11  parameters.  Altitude,  airspeed,  magnetic  heading,  engine  pressure  ratio  (EPR) 
engine  No.  1,  EPR  engine  No.  2,  and  microphone  keying  were  recorded  at  once-per-second  sampling 
intervals.  Parameters  that  were  sampled  more  frequently  than  once  per  second  were  roll  attitude  and  control 
column  position  versus  time  (two  times  per  second),  pitch  and  longitudinal  acceleration  (four  times  per 
second),  and  vertical  acceleration  (eight  times  per  second).  The  CVR  installed  on  the  incident  airplane, 
which  was  designed  to  preserve  about  30  minutes  of  data,  continued  to  record  after  the  upset  event  and 
recorded  over  the  data  pertinent  to  the  incident.  Because  no  pertinent  CVR  data  was  available,  the  Safety 
Board  referenced  the  incident  times  as  follows:  radar  time  equals  FDR  time  in  seconds  minus  11,000  plus 
2205:47  (local  eastern  standard  time). 
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"fighting,  trying  to  regain  control”  and  "standing  on  the  left  rudder.  According  to  the 
captain,  these  flight  control  inputs  slowed  the  yaw/roll  event;  however,  the  airplane  "was 
still  trying  to  roll,”  so  he  advanced  the  right  throttle  to  compensate  for  the  rolling  tendency 
with  differential  power.^^  The  captain  stated  that,  after  he  made  these  inputs,  the  airplane 
appeared  to  move  back  toward  neutral  "for  one  or  two  seconds”  and  "might  have 
momentarily  banked  left  because  of  all  the  correction  present”  before  returning  abruptly  to 
a  right  bank. 

The  flight  crew  performed  the  emergency  checklist,  which  included  disengaging 
the  yaw  damper.  Subsequently,  the  upset  event  stopped,  and  the  airplane  flew  normally  for 
the  remainder  of  the  flight.  The  pilots  reported  a  delay  of  several  seconds  between  the 
disengagement  of  the  yaw  damper  and  the  end  of  the  upset  event. 

During  postincident  interviews,  the  lead  flight  attendant  of  Eastwind  flight  517 
stated  that  she  was  standing  in  the  aisle  near  the  rear  of  the  airplane  cabin  before  the  upset 
began.  At  that  time,  she  heard  a  distinct  thump  from  below  but  not  directly  underneath  her 
feet.  (The  rear  flight  attendant  also  reported  hearing  a  thump  sound  while  the  airplane 
yawed  to  the  right)  She  reported  that,  immediately  after  the  thump  occurred,  the  airplane 
began  "rocking  with  a  violent  back  and  forth  motion....  The  motions... lasted  no  more 
than  fifteen  seconds,  were  violent  from  start  to  finish,  and  appeared  to  come  in  cycles.” 

The  FDR  data  revealed  that  the  airplane  rolled  rapidly  to  the  right  about  10°  with  a 
simultaneous  heading  change  to  the  right  of  about  5°  per  second.  The  FDR  data  also 
revealed  that  the  airplane  rolled  back  to  the  left,  to  a  maximum  left  bank  angle  of 
approximately  15°,  while  the  right  engine  thrust  increased.’’  (The  airplane  was  in  a  15° 
left  bank  for  approximately  3  seconds  and  remained  in  a  left  bank  for  an  additional 
9  seconds  while  the  engine  thrust  increased;  however,  the  FDR  recorded  little  heading 
change.)  While  the  right  engine  pressure  ratio  (EPR)  increased,  the  airspeed  increased  from 
about  250  to  about  254  knots.  The  airplane’s  heading  changed  to  the  left;  hesitated  at  about 


During  an  interview  5  days  after  the  incident,  the  captain  estimated  that  he  input  about  40  to  45  of 
control  wheel  displacement  and  stated  that  “the  airplane  seemed  to  hold  in  a  25  to  30°  bank.”  A  statement 
obtained  from  the  first  officer  at  the  same  time  was  consistent  with  the  captain’s  estimates  of  control  wheel 
input  and  bank  angle.  However,  during  an  interview  10  days  later,  the  captain  indicated  that  a  flight  test  m 
which  the  airplane  rolled  about  15°  “provided  a  better  recreation  of  the  motions  of  the  airplane  during  the 
incident.”  (FDR  data  indicated  that  the  incident  airplane  rolled  between  10  and  15°  during  the  upset  event) 
Although  both  pilots  estimated  the  captain’s  control  wheel  input  during  the  incident  to  be  about  40  to  45°, 
Safety  Board  and  Boeing  kinematic  studies  indicated  that  the  initial  control  wheel  input  was  closer  to  60°. 
Additionally,  during  the  interview  5  days  after  the  incident,  the  captain  estimated  that  he  input  about  3  to  4 
inches  of  left  rudder  pedal  displacement;  however,  in  an  interview  2  years  later,  the  captain  stated  that  the 
rudder  pedals  moved  no  more  than  1  or  2  inches.  The  captain  stated  that  he  immediately  put  a  lot  of 
pressure  on  the  rudder  pedals  but  that  they  “did  not  go  down  to  the  floor.” 

^  During  postincident  interviews,  the  captain  told  Safety  Board  investigators  that  his  automatic 
decision  to  use  differential  power  to  counter  the  yaw/roll  event  reflected  his  experience  in  turbopropeller- 
driven  airplanes. 

’’  About  5  seconds  after  the  beginning  of  the  upset,  the  EPR  values  for  the  right  (No.  2)  engine  began  to 
increase.  The  right  engine  EPR  values  increased  to  a  maximum  of  1.32;  remained  constant  at  1.26  for 
5  seconds;  increased  to  1.30  for  1  second;  and  then  decreased  to  about  1.01,  which  was  consistent  with  EPR 
values  of  the  left  (No.  1)  engine  for  the  entire  incident. 
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242°;  and  began  a  series  of  heading  oscillations  of  decreasing  magnitude,  including  a  left 
heading  excursion  of  4.1°  and  a  right  heading  excursion  of  5.6°  (both  in  1  second).  During 
the  heading  oscillations,  the  airplane’s  roll  attitude  also  oscillated  between  an  approximate 
wings-level  attitude  and  10°  left  wing  down  (LWD).  The  heading  and  roll  oscillations 
decreased  while  the  airplane  maintained  an  approximate  constant  heading  of  about  240°. 

Postincident  examination  of  the  airplane’s  maintenance  records  revealed  three 
flight  crew-reported  rudder-related  events  during  the  month  preceding  the  incident.  The 
first  event  occurred  on  May  14,  1996,  when  the  captain  of  the  June  9  Eastwind  incident 
flight  experienced  a  series  of  uncommanded  “taps”  on  the  right  rudder  pedal  just  after 
takeoff,  which  he  stated  felt  “like  someone  hitting  their  foot  on  the  right  rudder.”  The 
captain  returned  to  the  departure  airport  and  landed  without  further  incident.  As  a  result  of 
the  uncommanded  rudder  movements  reported  to  have  occurred  on  May  14,  the  main 
rudder  PCU  was  replaced  that  same  day,’^  and  the  airplane  was  returned  to  service.^ 
During  a  May  21  overnight  inspection,  rudder  sweep  and  PCU  leak  examinations  were 
conducted. 

The  captain  reported  that  the  rudder  pedal  bumps  he  experienced  on  May  14  felt 
identical  to  the  rudder  pedal  bump  he  felt  at  the  onset  of  the  yaw/roll  event  on  June  9. 
Additionally,  the  Eastwind  flight  517  lead  flight  attendant  was  a  cabin  crewmember  on  the 
May  14  flight,  during  which  the  captain  experienced  the  uncommanded  rudder  “taps.”  The 
flight  attendant  stated  that  she  did  not  hear  any  sounds  during  the  May  14  event  and 
reported  that  the  event  was  much  less  intense  than  the  June  9  incident.  She  was  in  the  front 
of  the  cabin  during  the  May  14  event  but  was  near  the  rear  of  the  cabin  during  the  June  9 
incident. 

The  other  two  uncommanded  yaw/roll  events  were  reported  to  have  occurred  on 
June  1  and  June  8, 1996.’“  As  a  result  of  these  reports,  the  yaw  damper  transfer  valve  and 
the  yaw  damper  linear  variable  displacement  transducer  (LVDT)  were  removed  and 
replaced  on  June  8.  The  incident  pilots  performed  a  postmaintenance  test  flight  on  the 
morning  of  June  9  and  reported  that  the  airplane  performed  normally,  with  no  rudder 
system  anomalies  noted  during  the  test  flight.  Because  the  airplane  performed 
satisfactorily  during  the  test  flight,  it  was  returned  to  service. 

When  Safety  Board  investigators  examined  the  rudder  system  and  the  main  rudder 
PCU  after  the  June  9  incident,  they  observed  that  the  rudder’s  yaw  damper  system  had 
been  adjusted  such  that  the  rudder  neutral  (at  rest)  position  was  1.5°  to  the  left  when  the 


The  Eastwind  flight  517  main  rudder  PCU  servo  valve  was  assembled  and  tested  at  Parker  on 
April  15,  1996. 

^  As  a  result  of  the  uncommanded  rudder  movements  reported  to  have  occurred  on  May  14  (and 
another  undocumented  rudder  event  that  occurred  on  or  about  May  31),  on  June  2,  1996,  Eastwind  issued 
Flight  Crew  Briefing  Bulletin  96-03,  which  advised  company  pilots  of  the  circumstances  of  the  events  and 
requested  that  pilots  notify  maintenance  immediately  if  an  unexplained  yaw  movement  occurred. 

The  airplane’s  June  1,  1996,  logbook  entry  stated,  “...[airplane]  may  have  exp[erienced]  2  each 
[slight]  rudder  yaws  [to]  the  left. ..approx[imately]  30  sec[onds]  apart —  No  rudder  pedal  movement....” 
The  June  8,  1996,  logbook  entry  stated,  “with  yaw  damper  off  in  level  flight  aircraft  rolls  to  the  right  and  the 
yaw  damper  test  indicator  also  goes  to  the  right.” 
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yaw  damper  system  was  engaged  and  the  rudder  trim  was  set  at  zero.  The  active  yaw 
damper  could  move  the  rudder  1.5°  farther  to  the  left  of  this  neutral  position  and  4.5°  to 
the  right  of  this  neutral  position  with  no  aerodynamic  loads.'®*  Postincident  PCU  testing  at 
Parker’s  facility  indicated  that  the  yaw  damper  LVDT  neutral  position  was  incorrectly  set. 
(The  normal  limit  of  yaw  damper  authority  on  the  rudder,  if  properly  set,  would  have  been 
3°  to  the  left  and  3°  to  the  right  of  the  rudder’s  neutral  position.) 

Additional  examination  and  testing  conducted  by  the  Safety  Board,  Eastwind,  and 
Boeing  revealed  that  the  wiring  from  the  yaw  damper  coupler  to  the  main  rudder  PCU  was 
chafed  and  could  have  resulted  in  a  short  circuit,  causing  a  full  yaw  damper  command  left 
or  right.  Additionally,  examination  of  the  yaw  damper  system  revealed  damage  from 
infiltration  of  fluid  that  was  consistent  with,  but  not  conclusive  evidence  of,  an  electrical 
fault.  The  main  rudder  PCU  and  yaw  damper  coupler  were  removed  and  replaced,  new 
wiring  was  installed  between  the  PCU  and  the  yaw  damper  coupler,  and  the  airplane  was 
returned  to  service.  To  date,  no  further  pilot  complaints  or  maintenance  writeups  regarding 
rudder  “bumps”  or  other  anomalous  rudder  motions  have  been  reported  on  the  incident 
airplane. 

1.16.2  Wake  Vortex  Tests  and  Studies  Resulting  From  the 
USAir  Flight  427  Accident 

The  PIT  Automated  Radar  Terminal  System  III  radar  tracking  data  indicated  that 
the  only  airplanes  operating  in  the  vicinity  of  USAir  flight  427  when  the  upset  occurred 
were  Atlantic  Coast  flight  6425,  a  Jetstream  31  that  had  just  departed  PIT  and  was 
climbing  and  heading  north,  and  Delta  flight  1083,  a  727-200  that  was  preceding  USAir 
flight  427  to  PIT.  The  Safety  Board  plotted  radar  tracking  data  for  these  three  airplanes  to 
determine  whether  the  wake  vortices'®^  from  either  the  Atlantic  Coast  or  Delta  airplanes 
might  have  played  a  role  in  the  USAir  airplane’s  accident  sequence. 

The  radar  data  indicated  that,  at  the  time  of  the  upset,  USAir  flight  427  and 
Atlantic  Coast  flight  6425  were  separated  by  1,500  feet  vertically  (flight  427  was  at  the 
higher  altitude)  and  3.5  nautical  miles  (nm)  horizontally  (with  flight  427  northwest  of 
flight  6425).  About  8  seconds  later  (about  1903:11),  radar  data  showed  that  USAir  flight 
427  was  at  5,300  feet  msl  (600  feet  above  Atlantic  Coast  flight  6425)  and  that  the 
airplanes  were  3.1  nm  apart.  About  1903:20,  the  radar  data  indicated  that  USAir  flight  427 
was  at  2,300  feet  msl  (2,600  feet  below  Atlantic  Coast  flight  6425)  and  that  the  airplanes 
were  2.8  nm  apart. '®^  The  radar  tracks  of  the  two  airplanes  did  not  cross  at  any  time. 


With  the  rudder  trim  set  at  zero,  the  yaw  damper  travel  limits  were  ±  3°  about  the  0°  rudder  position 
(not  the  rudder’s  neutral  position). 

According  to  the  FAA’s  Aeronautical  Information  Manual,  all  airplanes  generate  wake  vortices  (a 
pair  of  counterrotating  airmasses  trailing  from  the  wing  tips)  while  in  flight.  The  strength  of  these  vortices 
depends  on  the  weight,  speed,  and  shape  of  the  wing  of  the  generating  aircraft.  The  greatest  vortex  strength 
occurs  when  the  generating  aircraft  is  heavy,  in  a  clean  configuration,  and  at  a  slow  airspeed. 

The  recorded  radar  data  plots  and  separation  tables  are  included  in  the  Performance  Group 
Chairman’s  Report  of  Investigation,  dated  January  14,  1995. 
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The  radar  data  showed  that  Delta  flight  1083  was  descending  through  6,300  feet 
msl  on  an  easterly  heading  when  it  passed  the  approximate  location  where  the  initial  upset 
of  USAir  flight  427  subsequently  occurred.  The  accident  airplane  reached  that  location 
about  69  seconds  after  Delta  flight  1083.  According  to  information  provided  by  Delta  Air 
Lines  and  ATC  records,  Delta  flight  1083  would  have  been  operating  at  an  estimated 
weight  of  126,400  pounds,  in  the  flaps  1  configuration,  and  at  an  ATC-assigned  airspeed 
of  190  knots  when  it  passed  the  location  where  the  initial  upset  occurred.  USAir  flight 
427,  also  on  an  easterly  heading,  was  at  6,000  feet  msl  when  the  initial  upset  occurred. 
The  closest  Delta  flight  1083  and  USAir  flight  427  were  to  each  other  was  4.1  nm  apart 
(both  airplanes  were  at  6,000  feet  msl)  about  24  seconds  before  the  upset  occurred.  About 
the  time  of  the  upset  (1902:50),  the  distance  between  the  two  airplanes  had  increased  to 
4.5  nm. 


NASA  and  Safety  Board  aerodynamics  experts  performed  a  study  of  the  most 
likely  movement  of  the  wake  vortices  produced  by  Delta  flight  1083  (at  its  estimated 
weight  and  configuration).  The  study  indicated  that  the  wake  vortices  would  have  drifted 
with  the  wind"^  and  descended  at  a  rate  of  300  to  500  feet  per  minute.  On  the  basis  of 
these  rates,  the  wake  vortices  would  have  likely  descended  to  between  5,800  and  6,000 
feet  msl  during  the  69  seconds  after  Delta  flight  1083  descended  through  6,300  feet  msl 
near  the  location  of  the  initial  upset.  The  study  indicated  that  USAir  flight  427  most  likely 
encountered  the  wake  vortices  produced  by  Delta  flight  1083  about  the  time  of  the  initial 
upset. 


In  September  and  October  1995,  the  Safety  Board  conducted  a  series  of  flight  tests 
near  Atlantic  City,  New  Jersey,  to  examine  the  aerodynamic  effects  of  727-generated  wake 
vortices  on  a  737.  These  tests  were  conducted  with  participation  and  support  from  parties 
to  the  USAir  flight  427  investigation,  including  the  FAA,  Boeing,  USAir,  and  the  Air  Line 
Pilots  Association  (ALFA),  as  well  as  other  interested  parties,  including  NASA.  The  tests 
used  a  highly  instrumented  737-300  provided  by  USAir’®^  and  a  727-100  owned  by  the 
FAA  and  equipped  with  wing-tip  smoke  generators  to  assist  in  the  visual  identification  of 
the  wake  vortex  core.’°^  To  accurately  simulate  the  wake  turbulence  conditions 
encountered  by  the  accident  airplane,  the  test  airplanes  were  loaded  to  the  approximate 
weights  of  USAir  flight  427  and  Delta  flight  1083  at  the  time  of  the  wake  vortex 
encounter.  Most  of  the  flight  tests  were  conducted  in  early  morning  hours  when  calmer 


As  previously  indicated,  a  radiosonde  balloon  that  was  launched  approximately  6  miles  southeast  of 
the  accident  site  about  11  minutes  after  the  accident  measured  winds  at  6,000  feet  msl  from  274°  at  15  knots. 

The  737  used  for  the  wake  turbulence  flight  tests  (which  was  flown  by  FAA,  Boeing,  USAir,  and 
ALFA  pilots  during  the  flight  tests)  was  equipped  (by  Boeing)  with  an  FDR  that  had  enhanced  recording 
capabilities.  More  parameters,  such  as  control  input  and  control  surface  position,  were  included,  and 
parameters  were  sampled  and  recorded  more  frequently  than  those  parameters  recorded  by  the  FDR  on  the 
accident  airplane.  The  flight  test  airplane  also  had  a  digital  audiotape  recorder  and  a  video  recording  system 
with  seven  cameras  (two  in  the  cockpit  facing  forward  out  the  windshield,  one  in  the  cockpit  facing  the 
flight  crew  and  the  instruments,  one  under  each  wing  tip  facing  forward,  one  on  the  vertical  fin  facing 
forward,  and  two  in  the  midcabin  facing  out  windows  toward  the  wing  tips).  A  T-33  observation  airplane 
(provided  by  Boeing)  also  used  video  recording  equipment  to  document  the  flight  tests. 

The  727-100  provided  by  the  FAA  (and  flown  by  FAA  flight  test  pilots)  for  the  wake  turbulence 
flight  tests  is  shorter  than  the  727-200,  but  both  airplanes’  wing  lengths  and  shape  are  identical. 
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atmospheric  conditions  would  be  most  likely  to  permit  strong,  stable,  long-lasting  wake 
vortices. 

During  the  tests,  the  737  penetrated  the  727’s  smoke-indicated  wake  vortex  cores 
about  150  times'*^^  from  various  intercept  angles;  in  turns,  climbs,  descents,  and  level 
flight  at  various  altitudes;’®^  and  at  separation  distances  of  between  2  and  4.2  nm  (US Air 
flight  427  and  Delta  flight  1083  were  4.5  nm  apart  at  the  time  of  the  upset).  For  other 
flight  test  conditions,  the  flight  test  pilots  positioned  the  737  so  that  specific  airplane 
surfaces  (for  example,  left  wing,  right  wing,  vertical  fin,  engine,  and  fuselage)  passed 
through  the  wake  vortex  cores.  The  pilots  performed  intercepts  under  the  following 
conditions:  autopilot  on  without  pilot  input,  autopilot  on  with  pilot  input  (in  CWS  mode), 
autopilot  off  without  pilot  input  (hands  off),  and  autopilot  off  with  pilot  input. 

Information  was  obtained  from  the  videotapes,  enhanced  FDR,  Boeing’s  portable 
airborne  digital  data  system  (PADDS),'*’^  the  2-hour  CVR  installed  on  the  737,  and  test 
pilot  statements.  These  data  revealed  that  the  727  wake  vortices  remained  intact  as  much 
as  6  to  8  miles  behind  the  wake-generating  airplane,  and  wake  strength  values  ranged  from 
800  to  1,500  feet/sec^.  The  videotapes  revealed  numerous  examples  of  wake  vortices 
breaking  apart;  linking  up;  and  moving  up,  down,  and  sideways.  The  737  encounters  with 
the  wake  vortices  occasionally  resulted  in  rapid  airspeed  fluctuations  of  ±  5  knots, 
although  some  fluctuations  resulted  from  the  wake  vortices’  interaction  with  the  pitot- 
static  system  and  low-level  (±  0.1  G)  turbulence. 

Further,  the  data  showed  that  the  wake  vortices  did  not  move  in  a  straight  or 
uniform  path  (as  previously  assumed  by  wake  turbulence  models  that  had  been  developed 
before  the  accident).  Rather,  flight  test  participants  noted  large  fluctuations  in  the  vertical 
position  of  the  wake  vortex  cores  over  short  distances.  The  wake  movement  was 
especially  unpredictable  when  the  wake  was  generated  during  a  descent.  During  public 
hearing  testimony  related  to  the  USAir  flight  427  accident,  Boeing’s  flight  test  pilot 
described  the  727  wake  vortices  as  follows: 

...the  wakes... stay  at  this  three,  four,  five  foot  diameter  core  all  the  way 
back  until  they  burst....  They  flow  left,  right,  up  and  down,  inside  maybe  a 
15  foot  diameter  tube  on  a  stable  day.  It  is  possible  to  quickly  hit  the  same 
wake  twice,  because  the  wake  is  not  fixed  in  space.  You  could  possibly  get 
a  left  roll  and... [if]  the  wake  vortex  is  actually  on  your  left  side  at  that 
point. .  .if  you  cross  over,  it  means  that  you  roll  right  back  into  the  wake .... 


Data  from  the  150  wake  encounters  were  examined  to  identify  737  flight  characteristics  during  wake 
vortex  encounters;  CVR  sound  signatures  from  50  of  the  150  wake  encounters  were  selected  and  compared 
with  the  sounds  recorded  by  the  accident  airplane’s  CVR. 

According  to  the  FAA  test  pilot  involved  in  the  wake  turbulence  flight  tests,  part  of  the  flight  test 
safety  plan  “required  that  we  do  this  at  a  high  altitude. . .  15,000  feet  [msl]  or  greater,  in  case  there  was  some 
type  of  an  upset  that  would  take  some  time  to  recover  from....  We  were  above  a  deck  of  clouds  at  about 
[18,000]  or  19,000  feet  [msl]  for  the  first  encounter....” 

PADDS  is  a  high-rate,  self-contained  flight  test  data  recording  system  developed  by  Boeing  that  was 
installed  on  the  flight  test  airplane  to  allow  investigators  to  record  and  evaluate  parameters  that  were  not 
recorded  by  the  accident  airplane’s  FDR  system.  The  PADDS  system  recorded  all  data  at  higher  sampling 
rates  (20  times  per  second)  than  the  FDR  system  that  was  installed  on  the  incident  airplane. 
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According  to  the  flight  test  pilot  statements,  although  the  wake  encounters  had 
varying  effects  on  the  737  flight  handling  characteristics,  the  effects  usually  lasted  only  a 
few  seconds  and  did  not  result  in  a  loss  of  control  or  require  extreme  or  aggressive  flight 
control  inputs  to  counteract.  The  flight  test  pilots  with  experience  flying  in  air  carrier 
operations  stated  that  the  wake  encounters  experienced  during  the  flight  tests  were  similar 
to  those  that  they  had  experienced  during  normal  flight  line  operations.  The  pilots 
described  the  wake  encounters  as  “routine”  and  not  startling. 

The  flight  test  data  also  indicated  that  even  “routine”  wake  vortices  could  result  in 
strong  rolling**®  and  yawing  moments,’**  depending  on  the  wake  vortex  intercept  angle. 
During  public  hearing  testimony,  the  FAA  flight  test  pilot  reported  that,  at  wake  vortex 
intercept  angles  of  less  than  10°  (particularly  at  intercept  angles  of  between  2  and  5°),  the 
airplane  experienced  strong  rolling  tendencies.  However,  the  pilot  stated  that,  at  intercept 
angles  of  10°  or  more,  the  encounter  did  not  result  in  a  significant  rolling  moment, 
although  the  airplane  experienced  a  couple  of  sharp  bumps  as  it  crossed  the  wake  vortex. 
The  FAA  flight  test  pilot  reported  that,  when  the  airplane  encountered  the  wake  vortex 
with  no  autopilot  or  manual  control  (hands-off  condition),  he  observed  uncommanded  roll 
angles  between  15  and  30°.  When  the  airplane  encountered  the  wake  vortex  under  manual 
control  (hands-on  condition)  and  with  the  autopilot  on  (with  and  without  pilot  input),  the 
FAA  pilot  observed  roll  angles  between  10  and  20°. 

According  to  the  flight  test  pilots,  the  rolling  moment  tended  to  self-correct  as  the 
airplane  passed  through  the  wake  vortex.  The  FAA  flight  test  pilot  said  that  “the  airplane 
would  start  to  roll  as  you  [entered  the  wake] . .  .then  as  you  hit  the  right  vortex,  it  would  roll 
you  back  up  to  level  again....”  Several  of  the  flight  test  pilots  reported  that  the  wake 
vortex  encounters  were  generally  short  in  duration  (unless  the  pilots  intentionally 
maneuvered  the  airplane  to  stay  in  the  wake  effect)  because  the  wake  vortex  tended  to 
force  the  airplane  out  of  its  effects.  The  FAA  test  pilot  stated  that  it  was  very  difficult  to 
keep  the  airplane  in  the  vortex.  During  test  conditions  in  which  the  vortex  was  positioned 
on  the  top  of  the  airplane  and  hit  the  vertical  fin  (in  the  flaps  1  configuration  at  190  knots), 
the  pilot  reported  that  full  aileron  deflection  was  required  to  counter  the  vortices’  tendency 
to  push  the  airplane  out  of  the  vortex. 

During  the  public  hearing  testimony,  Boeing’s  flight  test  pilot  stated  that  he  did  not 
use  much  rudder  during  the  wake  turbulence  flight  tests;  rather,  he  used  mostly  aileron. 
The  pilot  stated  that  “the  only  time  you  use  the  rudder  pedal  is  when  you  have  a  definitive 
yawing  moment. . .  or  you  have  a  very. .  .high  rolling  moment. . . .”  Boeing’s  flight  test  pilot 
also  reported  that  “every  now  and  then,  I  started  to  use  the  rudder,  but  then  you  would 
translate  left  or  right  out  of  the  full  effect  of  the  [wake  vortex]  core  and  then  I  would  be 
left  with  either  putting. . .  the  [control]  wheel  back  in  or  leaving  the  rudder  there  and  just 
playing  with  the  [control]  wheel.”  The  pilot  stated  he  did  not  experience  anything  during 


''®  Boeing’s  flight  test  pilot  stated  that  the  effect  of  the  wake  turbulence  was  “a  bit  stronger  than  I  would 
have  expected...  [resulting  in]  probably  25  to  30  [degrees  of  roll].” 

Wake  turbulence-related  yawing  moments  were  transient  in  nature  and  did  not  result  in  large 
sustained  heading  changes. 
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the  wake  vortex  encounters  that  he  believed  would  prompt  a  pilot  to  apply  and  hold  full 
rudder. 


In  the  public  hearing  testimony,  the  flight  test  pilots  indicated  that  the  wake 
encounters  they  experienced  during  the  flight  tests  were  not  disorienting  or  violent  enough 
to  have  caused  a  sustained  loss  of  control.  However,  the  flight  test  pilots  said  that  a  strong 
wake  vortex  encounter  would  likely  be  startling  and  surprising  to  pilots  when  encountered 
unexpectedly  during  otherwise  smooth,  routine  flight  operations. 

The  wake  turbulence  encounter  flight  test  data  were  compared  with  the  results  of 
computer  flight  simulations”^  performed  at  Boeing  using  its  previously  developed 
mathematical  model.  The  comparison  indicated  that  the  simulation  model  adequately 
predicted  wake-induced  lift,  roll,  and  pitch  characteristics;  however,  the  mathematical 
model  did  not  accurately  predict  the  wake-induced  yawing  moment  characteristics  of  the 
airplane  during  certain  wake  encounters.  The  videotape  taken  during  the  flight  tests 
revealed  that,  when  the  airplane  passed  over  or  directly  through  the  wake  vortex  cores,  the 
wake  (as  shown  by  the  smoke)  was  disrupted  by  the  737’s  wings,  fuselage,  and  horizontal 
tail  surfaces;  under  these  circumstances,  the  yawing  moments  predicted  by  the  simulation 
were  not  evident  in  the  flight  test  data.  However,  when  the  airplane  was  slightly 
underneath  the  wake  so  that  its  vertical  tail  surface  passed  through  the  wake  vortex  core 
generated  by  the  727,  the  wake  that  contacted  the  vertical  tail  surface  had  not  been 
previously  disrupted.  The  flight  test  data  revealed  that  this  situation  resulted  in  a  transient 
yaw  response  that  exceeded  the  yaw  predicted  by  the  simulation  wake  turbulence  model. 

Boeing’s  mathematical  wake  vortex  model  was  refined  based  on  the  wake 
turbulence  encounter  flight  test  data,  and  additional  flight  simulations  were  performed  by 
investigators  to  further  evaluate  the  interaction  of  USAir  flight  427  with  Delta  flight 
1083’s  wake  vortices.  The  simulations  employed  various  wake  vortex  characteristics, 
wake  vorticities,  positions,  and  core  sizes;  the  accident  airplane’s  closure  rates  and 
intercept  angles  with  the  wake;  and  the  use  or  operation  of  the  airplane  s  autopilot,  yaw 
damper,  and  autothrottle.  Encounters  with  wake  vortices  in  these  simulations  did  not  result 
in  significant  problems  controlling  the  airplane. 


Flight  simulations  were  conducted  at  Boeing  using  its  computer  workstation-based  flight  simulation 
software  and  its  multipurpose  cab  (M-CAB)  engineering  simulator.  The  M-CAB  utilizes  a  standard, 
6  degree-of-freedom  motion  base  to  provide  some  acceleration  cues  to  the  occupants  of  the  cab.  The  motion 
base  can  replicate  some  short-term  accelerations  or  some  smaller  magnitude,  long-term  accelerations.  It  can 
rotate  the  cab  through  roll,  pitch,  and  yaw  angles  of  about  ±  30°  and  can  translate  the  cab  in  the  forward/aft, 
side,  and  vertical  directions  about  up  to  about  ±  2  feet.  Long-term  vertical  accelerations,  such  as  those  from 
sustained  normal  flight  loads,  cannot  be  duplicated.  Some  side  loads,  such  as  those  from  sustained  sideslips, 
can  be  duplicated  by  rolling  the  cab  to  a  steady  angle,  similar  to  tilting  a  chair  sideways.  Forward 
accelerations,  such  as  those  felt  during  a  normal  takeoff  roll  acceleration,  can  be  somewhat  replicated  by 
rotating  the  cab  upward  to  a  steady  pitch  attitude. 
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1 .16.3  Flight  and  Simulator  Tests  of  Effects  of  Various  Flight 
Control  and  System  Failures 

The  Safety  Board  used  Boeing’s  multipurpose  cab  (M-CAB)  engineering 
simulator,  “flown”  by  FAA  flight  test  pilots,  to  document  and  test  several  possible  737 
failure  or  malfunction  scenarios.  The  following  possible  flight  control/system  failure 
scenarios  were  examined: 

•  loss  of  engine  power,  with  various  flight  control  inputs  and  rates; 

•  asymmetric  thrust  reverser  extension; 

•  yaw  damper  hardover; 

•  leading  edge  asymmetry,  with  or  without  autoslats; 

•  asymmetric  autoslat  deployment  at  stickshaker; 

•  flap  malfunction; 

•  loss  of  roll  control  spoilers; 

•  elevator  malfunction; 

•  outer  slat  damaged  and  extended  over  wing;  and 

•  rudder  hardover,  at  various  rates  of  input,  with  AFS  on  and  off. 

Of  all  the  simulations  conducted,  only  the  rudder  hardover  simulation  produced 
results  that  were  generally  consistent  with  the  data  from  US  Air  flight  427 ’s  FDR.”^ 
Specifically,  some  of  the  results  of  the  M-CAB  simulation  of  the  rudder  hardover  scenario 
were  similar  to  FDR  heading  data  that  were  recorded  several  seconds  after  the  initial 
upset.  This  similarity  prompted  additional  investigation  of  rudder  hardover  scenarios. 

Because  the  pilots  who  flew  the  M-CAB  simulator  responded  differently  (either  in 
the  magnitude  or  the  timing  of  their  responses),  the  simulator  results  were  not  consistent 
among  the  pilots,  and  precise  matches  of  the  FDR  data  were  thus  not  possible.  As  a  result, 
the  Safety  Board  and  Boeing  conducted  flight  simulations  on  computer  workstations  to 
remove  the  individual  variances  introduced  by  the  pilots  who  participated  in  the  M-CAB 
study.  The  workstation  simulations  enabled  engineers  to  make  small  parametric  changes 
to  the  input  data  and  then  determine  the  effects  of  various  rudder  hardware  scenarios  and 
resultant  wheel  and  elevator  responses.  These  simulation  studies  are  discussed  in  section 
1.16.6. 


For  example,  for  an  asymmetric  thrust  reverser  extension  to  result  in  the  left  yawing  moment 
recorded  by  the  accident  airplane’s  FDR  during  the  first  several  seconds  of  the  upset,  the  right  engine  would 
have  had  to  have  been  in  forward  thrust  and  the  left  engine  in  reverse.  Boeing’s  calculations  revealed  that  the 
net  thrust  differential  required  to  sustain  the  left  yaw  recorded  by  the  FDR  during  the  first  few  seconds  of  the 
upset  would  be  37,890  pounds,  affecting  the  airplane’s  yaw  to  the  left.  However,  the  FDR’s  recorded  engine 
power  settings  (66  percent  N1  at  190  knots),  indicated  that  the  accident  airplane’s  engines  could  have  only 
been  producing  a  net  thrust  differential  of  13,269  pounds  (4,500  pounds  forward  thrust  on  the  right  engine 
and  8,769  pounds  reverse  thrust  on  the  left  engine),  affecting  the  airplane’s  yaw  to  the  left. 


Factual  Information 


60 


Aircraft  Accident  Report 


Boeing’s  M-CAB  simulator  was  also  used  to  conduct  postaccident  simulator 
flights  using  the  accident  airplane’s  FDR  data,  with  a  rudder  hardover  induced  either 
manually  or  electronically  to  represent  the  USAir  flight  427  upset  condition.  During  the 
simulator  exercise,  the  participants"'*  were  briefed  by  Boeing  personnel  regarding  the 
circumstances  of  the  USAir  flight  427  accident,  prepared  for  and  expecting  the  upset  event 
When  it  occurred,  and  coached  through  a  specific  recovery  technique  (full  right  control 
wheel  maintained  throughout  the  duration  of  the  event,  and  forward  control  column 
pressure  sufficient  to  reduce  the  normal  load  factor  and  maintain  airspeed  above  the 
crossover  point). The  pilots  were  able  to  recover  from  the  upset  (or  at  least  stabilize  the 
roll  to  the  point  at  which  a  continued  loss  of  control  would  not  have  likely  occurred)  when 
they  applied  the  recovery  technique  promptly  at  the  beginning  of  the  event.  If  the  pilots 
varied  their  responses  from  the  specific  techniques  that  they  were  told  to  apply  (for 
example,  when  they  modified  the  control  wheel  input  in  anticipation  of  the  simulator’s 
responses  to  the  inputs  or  applied  aft  control  column  pressure  to  maintain  6,000  feet),  it 
became  much  less  likely  that  the  pilots  would  successfully  recover  from  the  upset  event.) 

Additionally,  Safety  Board  investigators,  with  representatives  from  parties  to  the 
investigation  and  a  research  scientist  from  NASA’s  Ames  Research  Center,  documented 
possible  pilot  responses  to  the  upset  using  the  vertical  motion  simulator  (VMS)  at  the 
Ames  Research  Center."^  The  VMS  had  a  larger  range  of  motion  than  the  Boeing  M-CAB 
and  could  therefore  more  accurately  replicate  the  airplane  motion  recorded  by  the  accident 
airplane’s  FDR.  The  time  histories  of  the  airplane  motion,  as  documented  by  the  FDR  and 
the  initially  derived  positions  of  the  flight  control  surfaces  (based  on  computer 
workstation  modeling),  were  input  into  the  VMS.  In  addition,  a  portion  of  the  accident 
airplane’s  CVR  was  synchronized  to  the  FDR  data  and  replayed  during  the  VMS  runs.  The 
VMS  cab  did  not  resemble  a  737  cockpit;  however,  the  cab  included  a  view  of  a  computer- 
simulated  horizon,  which  was  adjusted  to  the  accident  airplane’s  attitude.  The  VMS 
allowed  participants  to  feel  the  motion  of  the  airplane,  listen  to  the  CVR  excerpts,  and 
view  the  horizon  and  control  inputs  to  assess  possible  flight  crew  responses  (such  as 
whether  the  flight  crew  might  have  responded  to  the  upset  with  left  rudder  pedal  input).  In 
addition,  a  NASA  specialist  on  human  spatial  orientation  rode  in  the  simulator  to  provide 
observations  on  the  possibility  that  pilot  disorientation  contributed  to  the  accident.  (See 
section  1.18.6.2  for  additional  discussion  regarding  the  NASA  specialist’s  observations.) 


Participants  in  these  postaccident  simulator  flights  included  pilots  and  nonpilots  from  the  Safety 
Board  and  parties  to  the  investigation. 

See  section  1.16.4  for  more  information  on  the  crossover  airspeed. 

A  research  scientist  from  NASA’s  Ames  Research  Center  described  the  VMS  as  “...a  full  6  degree- 
of-freedom  simulator  that  has  a  vertical  thrust  of  plus  and  minus  30  feet,  lateral  thrust  of  plus  and  nunus  20 
feet,  and  a  fore  and  aft  thrust  of  2.5  feet. . . .  there  are  full  visual  simulations  on  the  VMS . . . .”  The  motion  base 
of  the  VMS  simulator  permits  an  improved  replication  of  the  feel  of  the  airplane  motion  over  that  of 
Boeing’s  M-CAB  (or  most  other  motion-based  simulators.)  Although  the  acceleration  cues  are  better 
represented  by  the  VMS,  its  range  of  motion  limits  the  range  of  lateral  and  vertical  acceleration  cues 
available  to  the  occupants  of  the  VMS  cab. 
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1 .1 6.3.1  Eastwind  Flight  51 7  Flight  Tests 

On  June  22  through  24,  1996,  the  Safety  Board  conducted  flight  tests  in  the 
Eastwind  flight  517  incident  airplane,  with  Boeing,  FAA,  and  Eastwind  Airlines 
participation.  The  flight  tests  were  to  document  the  operation  and  limits  of  the  airplane’s 
yaw  damper  system,  test  and  record  the  airplane’s  responses  to  various  rudder  inputs,  and 
expose  the  captain  of  Eastwind  flight  517  to  various  rudder  inputs  and  document  his 
reactions  to  and  insights  on  the  inputs.  For  the  flight  tests,  the  airplane’s  yaw  damper 
system  bias  remained  misadjusted  so  that  it  could  command  1.5°  to  the  left  and  4.5°  to  the 
right  of  the  rudder’s  trimmed  position  (as  it  was  at  the  time  of  the  incident).  As  with  the 
wake  vortex  tests,  additional  test  equipment  and  instrumentation  were  installed  on  the 
incident  airplane  to  record  and  document  the  flights."’ 

During  the  ground  and  flight  tests,"^  the  incident  airplane  was  operated  with  a 
Boeing  flight  test  pilot  in  the  left  seat  and  an  FAA  flight  test  pilot  in  the  right  seat;  the 
captain  of  Eastwind  flight  517  and  additional  Boeing  and  FAA  personnel  were  seated  in 
the  cabin.  The  first  flight  test  was  conducted  at  altitudes  between  8,000  and  13,000  feet 
msl,  at  an  airspeed  of  250  knots,  and  with  the  yaw  damper  engaged  and  the  flaps  and 
landing  gear  retracted.  Attempts  were  made  to  induce  an  in-flight  yaw  damper  failure  and 
subsequent  hardover  command  through  a  series  of  rapid  and  abrupt  rudder  pedal  and 
control  wheel  inputs;  however,  the  flight  test  pilots  were  unsuccessful  in  inducing  a  yaw 
damper  hardover.  Before  the  second  test  flight,  the  incident  yaw  damper  coupler  was 
removed,  and  a  different  yaw  damper  coupler,  a  yaw  damper  fault  insertion  box,  and 
associated  wiring  were  installed  to  allow  the  flight  test  pilots  to  command  a  yaw  damper 
hardover  condition  using  an  electrical  signal. 

The  second  flight  test  was  also  conducted  at  altitudes  between  8,000  and  13,000 
feet  msl;  at  an  airspeed  of  250  knots;  and  with  the  yaw  damper  engaged,  autopilot 
disengaged,  and  flaps  and  landing  gear  retracted.  Yaw  damper  hardovers  to  the  left  and 
right  were  electronically  commanded  by  the  flight  crew  via  the  cockpit  switchbox,  and  the 
maximum  rudder  and  control  wheel  positions  needed  to  stabilize  the  airplane  were  noted. 
Additionally,  rudder  pedal  release  tests  were  conducted  using  the  following  procedures: 


During  the  Eastwind  flight  tests,  the  PADDS  system  recorded  28  parameters,  including  5  yaw 
damper-related  parameters  and  3  rudder  system  parameters,  which  provided  valuable  data  for  investigators. 
(The  Eastwind  flight  517  FDR  recorded  11  parameters,  none  of  which  provided  yaw  damper  or  rudder 
position  information.)  The  PADDS  system  recorded  all  data  at  higher  sampling  rates  (20  times  per  second) 
than  the  FDR  system  that  was  installed  on  the  airplane  at  the  time  of  the  incident.  Additionally,  a  digital 
audiotape  was  installed  to  record  CVR  data  beyond  the  normal  30-minute  duration,  and  a  Boeing  noise 
recording  system  was  installed  to  record  noises  emanating  from  the  aft  cabin  and  galley  area  during  the 
flight  tests  (to  determine  the  source  of  the  thump  noise  described  by  the  flight  attendants  from  flight  517). 

'**  Ground  taxi  tests  were  conducted  before  each  of  the  two  test  flights  to  test  the  rudder  and  yaw 
damper  system  for  anomalies  that  would  preclude  safe  test  flights  and  perform  operational  tests  of  the 
additional  test  equipment  and  instrumentation  installed  on  the  airplane. 


Factual  Information 


62 


Aircraft  Accident  Report 


•  While  maintaining  straight  and  level  flight  using  control  wheel  and  rudder 
pedal  inputs,  right  rudder  trim  was  added  in  1°  increments,  from  0  to  6°  trailing 
edge  right  rudder  position. 

•  Rudder  pedal  inputs  were  released. 

•  Rudder  position  and  control  wheel  input  needed  to  control  bank  angle  were 
noted. 

During  portions  of  the  second  flight  test,  the  captain  of  Eastwind  flight  517 
occupied  the  right  pilot  seat  previously  occupied  by  the  FAA  flight  test  pilot"^  and 
controlled  the  airplane  during  a  series  of  yaw  damper  hardover  insertions  and  rudder  pedal 
release  conditions  (including  four  yaw  damper  hardovers  of  4.5°  right  rudder,  three  rudder 
pedal  releases  from  the  6°  right  rudder  trim  position,  and  three  rudder  pedal  releases  from 
the  4°  right  rudder  trim  position). 

Recorded  FDR  and  PADDS  data  indicated  that  the  captain  responded  to  the  first 
yaw  damper  hardover  0.6  seconds  after  its  initiation  by  stepping  on  the  left  rudder  pedal. 
The  flight  test  FDR  data  indicated  that  the  airplane’s  bank  angle  increased  to  a  maximum 
of  about  4.5°  right  wing  down  (RWD)  and  that  its  heading  changed  about  2°  (both  in 
1  second)  before  the  airplane  responded  to  the  Eastwind  flight  517  captain  s  recovery 
efforts.  During  the  three  subsequent  yaw  damper  hardovers,  the  Eastwind  flight  517 
captain,  at  the  direction  of  the  Boeing  flight  test  pilot,  allowed  the  airplane  to  respond  to 
the  hardover  condition  for  a  few  seconds  before  the  captain  responded  with  rudder  pedal 
input. 

When  the  Eastwind  flight  517  captain  was  exposed  to  the  6°  right  rudder  pedal 
release  test  condition  (during  which  FDR  and  PADDS  equipment  recorded  a  4°  right 
heading  excursion  and  a  bank  angle  increase  to  8°  RWD,  both  within  2  seconds),  he  stated 
“that  was  more  like  it.”  (The  incident  FDR  data  indicated  a  4.1°  right  heading  change 
within  1  second  and  a  maximum  bank  angle  increase  to  10°  RWD  within  2  seconds.) 

The  Eastwind  flight  517  captain  indicated  that  the  motion  of  the  airplane  during 
the  portion  of  the  second  test  flight,  for  which  he  was  seated  in  the  right  pilot  seat  in  the 
cockpit,  was  similar  to  the  airplane  motion  he  recalled  experiencing  during  the  incident 
and  that  the  yoke  pressure  felt  the  same.  However,  the  captain  indicated  that  the  rudder 
response  during  the  first  and  second  tests  seemed  different  from  what  he  experienced 
during  the  incident.  He  stated  that  the  rudder  felt  stiffer  and  less  effective  during  the  actual 
incident. 


The  FAA  test  pilot  moved  to  the  cockpit  observer  jumpseat  and  continued  to  control  the  yaw  damper 
hardover  switchbox. 


Factual  Information 


63 


Aircraft  Accident  Report 


1.16.4  Flight  Control  Characteristics  Fiight  Tests  (Biowdown 
and  Crossover  Airspeed) 

In  September  1995,  a  series  of  flight  tests  were  conducted  from  Boeing  Field  in 
Seattle,  Washington,  to  validate  existing  and  acquire  additional  aerodynamic  data  for  the 
737-300  flight  simulator  data  tables,  study  the  airplane’s  performance  during  high  sideslip 
conditions,  and  measure  the  airplane’s  response  to  various  roll  and  yaw  inputs.  The  flight 
tests  were  conducted  with  the  USAir  737-300  that  was  used  for  the  wake  vortex  tests 
conducted  in  September  and  October  1995  (see  section  1.16.2).  The  flight  tests  included 
operating  the  737-300  (instrumented  with  the  Boeing  PADDS  system)  at  a  flaps  1  setting 
and  at  airspeeds  from  150  to  225  knots  calibrated  airspeed  (KCAS).  The  flight  test 
conditions  included  steady  heading  sideslips;  airplane  roll  response  to  control  wheel  input, 
rudder  pedal  input,  cross  controls  of  control  wheel  and  opposite  rudder  pedal  input,  and 
combined  controls  of  control  wheel  and  rudder  pedals;  autopilot  turns;  and  slowdown 
turns  to  aerodynamic  stall. 

Several  flight  test  conditions  required  the  test  pilots  to  maintain  control  of  the 
airplane  and,  if  possible,  a  constant  (or  steady)  heading  by  using  the  control  wheel  to 
oppose  full  rudder  surface  deflections.  These  tests  revealed  that,  in  the  flaps  1 
configuration  and  at  certain  airspeeds,  the  roll  authority  (using  spoilers  and  ailerons)  was 
not  sufficient  to  completely  counter  the  roll  effects  of  a  rudder  deflected  to  its  blowdown 
limit.  The  airspeed  at  which  the  maximum  roll  control  (full  roll  authority  provided  by 
control  wheel  input)  could  no  longer  counter  the  yaw/roll  effects  of  a  rudder  deflected  to 
its  blowdown  limit  was  referred  to  by  the  test  group  participants  as  the  “crossover 
airspeed.” 

The  flight  tests  revealed  that,  in  the  flaps  1  configuration  and  at  an  estimated 
aircraft  weight  of  110,000  pounds,'^®  the  737-300  crossover  airspeed  was  187  KCAS  at 
one  At  airspeeds  above  187  KCAS,  the  roll  induced  by  a  full  rudder  deflection  could 
be  corrected  by  control  wheel  input;  however,  in  the  same  configuration  at  airspeeds  of 
187  KCAS  and  below,  the  roll  induced  by  a  full  rudder  deflection  could  not  be  completely 
eliminated  by  full  control  wheel  input  in  the  opposite  direction,  and  the  airplane  continued 
to  roll  into  the  direction  of  the  rudder  deflection.  The  flight  test  data  also  confirmed  that  an 
increase  in  vertical  load  factor,  or  angle-of-attack,  resulted  in  an  increase  in  the  crossover 
airspeed. 

The  flight  tests  also  revealed  that  the  test  airplane’s  rudder  traveled  slightly  farther 
than  originally  indicated  by  Boeing’s  737-300  computer  models  before  reaching  its 
aerodynamic  blowdown  limit.  Data  from  tbe  flight  test  were  incorporated  into  Boeing’s 
M-CAB  engineering  software,  and  flight  simulations  were  performed.  The  M-CAB  flight 
simulations  indicated  that,  with  a  rudder  deflected  to  its  aerodynamic  blowdown  limit  and 
in  the  configuration  and  conditions  of  the  USAir  flight  427  accident  airplane,  the  roll 


At  the  time  of  the  initial  upset,  USAir  flight  427  had  an  estimated  operating  weight  of  108,600 
pounds  and  was  operating  at  an  airspeed  of  about  190  knots. 

One  G  is  equivalent  to  the  acceleration  caused  by  the  earth’s  gravity  (32.174  feet/sec^). 
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could  not  be  completely  eliminated  (and  control  of  the  airplane  could  not  be  regained)  by 
using  full  control  wheel  inputs  if  the  airspeed  remained  below  187  KCAS.  The  pilots  who 
were  involved  in  the  flight  and  simulator  tests  indicated  that  successful  recovery  required 
immediate  flight  crew  recognition  of  the  upset  event  and  subsequent  prompt  control  wheel 
inputs  to  the  full  authority  of  the  airplane’s  roll  control  limits  and  pitch  flight  control 
inputs  to  maintain  a  speed  above  the  crossover  airspeed.  To  return  the  airplane  to  a 
wings-level  attitude,  the  pilots  had  to  avoid  excessive  maneuvering  that  would  increase 
the  vertical  load  factor,  or  angle-of-attack,  and  thus  increase  the  crossover  airspeed. 

In  June  1997,  additional  flight  tests  were  conducted  by  FAA  and  Boeing  test 
pilots*^^  using  a  newly  manufactured  737-500^^'*  to  obtain  additional  information 
regarding  crossover  airspeeds  and  quantify  737-300  controllability,  handling 
characteristics,  techniques,  and  altitude  required  for  recovery  from  rudder  deflections  to 
aerodynamic  blowdown  limits.  (Earlier  flight  tests  had  been  limited  to  75  percent  of  the 
available  rudder  rate  deflection  because  of  concern  that,  at  higher  deflection  rates,  the 
vertical  fin  would  be  overstressed  during  a  dynamic  maneuver.)  The  flight  test  conditions 
included  full-rate  rudder  deflections  and/or  maximum  rate  aileron  roll  maneuvers  that 
were  initiated  at  various  airspeeds,  configurations,  and  aircraft  weights  and  with  variable 
pilot  responses  (delayed  and  immediate  response,  aggressive  flight  control  input,  and 
autopilot  on  and  off).  During  the  tests,  strain  gauges  attached  to  the  vertical  fin  revealed 
that  the  full-rate  rudder  deflections  did  not  exceed  the  design  loads  for  the  vertical  fin 
structure.  Because  the  flight  test  airplane  was  to  be  subsequently  delivered  to  a  customer, 
all  maneuvers  were  conducted  within  the  airspeed,  G,  and  roll  angle  limitations  specified 
in  the  737  airplane  flight  manual  (AFM). 

The  Boeing  test  pilots  described  the  handling  of  the  airplane  when  they  applied 
full  left  rudder  with  the  test  airplane  configured  similar  to  the  USAir  flight  427  accident 
airplane  (190  knots  and  flaps  1).  One  pilot  described  how  the  airplane  would  initially 
respond  to  aileron  inputs  and  begin  to  roll  out  of  the  rudder-induced  bank  attitude  and 
how,  by  pulling  back  on  the  control  column  and  adding  some  vertical  load  factor,  the 
recovery  could  be  stopped  and  the  airplane  could  hang  in  a  sideslip  bank.  The  test  pilot 
said  that  he  did  not  apply  additional  aft  column  inputs  at  these  moments  but  that  these 
inputs  would  have  caused  the  airplane  to  “roll  into  the  rudder.  ’  The  pilot  concluded  that 
“you  can  control  roll  rate  with  the  control  column.”  The  other  Boeing  test  pilot  said  that, 
in  referring  to  the  control  inputs  required  to  perform  a  recovery  from  full  rudder  input, 
“there  is  some  technique  required  between  the  G  [normal  load  factor]  and  the  roll.” 


122  pjjQfg  who  participated  in  these  M-CAB  simulations  reported  that,  for  a  full  rudder  hardover 
condition  with  an  airspeed  greater  than  187  KCAS,  they  initially  applied  full  opposite  control  wheel  and 
then  slightly  reduced  the  wheel  deflection  in  response  to  the  recovery  rate.  The  pilots  then  found  it  necessary 
to  apply  more  wheel  to  counter  the  roll  being  produced  by  the  rudder.  The  pilots  reported  that  three  such 
cycles  of  the  wheel  were  normally  required  to  find  the  control  wheel  position  that  would  neutralize  the  roll. 

Safety  Board  staff  were  not  on  board  the  airplane  during  the  flight  tests.  However,  Safety  Board 
investigators  helped  design  the  test  procedures,  attended  postflight  debrief  sessions  and  discussions,  and 
reviewed  all  the  data  gathered  during  the  flight  tests. 

The  737-500  series  airplane  is  approximately  8  feet  shorter  than  the  737-300  series  and  requires  less 
roll  authority  (ailerons  and  spoilers)  to  counter  the  effects  of  a  rudder  deflection.  After  the  flight  tests, 
Boeing  adjusted  the  data  in  the  737  simulator  model  to  account  for  this  difference. 
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The  flight  test  pilots  affirmed  that  the  Boeing  M-CAB  and  computer  simulation 
models  incorporated  the  tradeoff  between  normal  load  factor  and  roll  control  but  that  the 
tradeoff  occurred  at  a  greater  load  factor  in  the  simulator  than  in  the  airplane.  (Thus,  the 
airplane  was  somewhat  more  prone  to  a  loss  of  roll  control  from  an  aft  control  column 
input  than  was  the  simulator.)  The  flight  test  pilots  said  that  the  Boeing  simulation  would 
need  to  be  modified  according  to  the  flight  test  results. 

Boeing’s  flight  test  pilots  stated  that,  when  they  allowed  the  airspeed  to  increase  to 
about  220  to  225  KCAS  (sacrificing  altitude  as  necessary  to  maintain  airspeed), the 
airplane  recovered  easily.  The  pilots  reported  that,  when  they  initiated  the  event  at  higher 
airspeeds,  the  airplane  was  easier  to  control  and  that  recovery  was  accomplished  with  less 
roll.  The  Boeing  flight  test  pilots  also  indicated  that,  when  the  airplane  was  configured  at 
higher  flap  settings  at  the  initiation  of  the  event,  recovery  was  easier  but  that  the  airframe 
experienced  considerable  vibration. 

1.16.5  Examination  and  Testing  of  Flight  Control 
Systems/Components 

The  737  flight  control  systems  from  the  USAir  flight  427  airplane  were  examined 
and  tested  to  determine  if  they  were  a  factor  in  the  upset  event  and  the  accident. 
Examination  of  the  airplane’s  flight  control  system  components  revealed  no  physical 
evidence  of  preimpact  malfunction.  The  Safety  Board  also  examined  and  tested  the 
accident  airplane’s  rudder  system  components,  including  rudder  pedal  assemblies;  rudder 
cables;  and  standby  and  main  rudder  PCUs,  yaw  damper,  linkages,  and  input  arms. 

1.16.5.1  Rudder  Pedal  Assemblies 

The  accident  airplane’s  rudder  pedal  assemblies  from  both  flight  crew  positions 
were  removed  from  the  wreckage.  Both  rudder  pedal  assemblies  were  fragmented  and 
heavily  distorted.  The  rudder  pedal  assembly  from  the  first  officer’s  position  exhibited 
postimpact  fire  damage.  The  left  rudder  pedal  pivot  lugs  on  both  rudder  pedal  assemblies 
were  fractured  near  their  respective  support  tubes. Figure  12  shows  a  diagram  of  the 
rudder  pedal  assemblies  as  installed  on  the  accident  airplane. 

The  rudder  pedal  assemblies  were  visually  and  microscopically  examined  by  a 
Safety  Board  metallurgist  and  others  on  December  8,  1994,  at  Boeing’s  Equipment 
Quality  Analysis  Laboratory  in  Renton,  Washington.  According  to  the  Safety  Board 
metallurgist,  microscopic  examination  of  the  fracture  faces  revealed  features  typical  of 
bending  overstress  fractures  on  both  pivot  lugs.  With  the  support  tubes  positioned 
vertically,  both  left  rudder  pedal  pivot  lugs  failed  in  the  forward  (and  slightly  downward) 


The  test  pilots  indicated  that  the  amount  of  altitude  lost  during  the  recoveries  varied  but  that,  with  a 
prompt  response  and  good  technique,  control  could  be  regained  with  a  loss  of  less  than  500  feet.  The  pilots 
also  indicated  that,  if  they  did  not  have  to  comply  with  the  vertical  load  factor  restrictions  imposed  for  the 
tests,  they  would  have  been  able  to  recover  with  less  lost  altitude. 

During  normal  operation,  the  rudder  pedal  pivot  lugs  are  held  stationary  in  the  upper  ends  of  the 
support  tubes  and  allow  the  pedals  to  pivot  and  articulate  as  they  are  activated  and  as  the  brake  is  applied. 
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First  Officer's  Rudder  Pedals 


Captain's  Rudder  Pedals 


Bus  Rod  between 
Captain's  and  First 
Officer's  Control 
Quadrants 


Figure  12.  Rudder  pedal  assemblies  as  installed  on  the  USAir  flight  427  airplane. 

direction.  The  right  rudder  pedal  pivot  lugs  on  both  assemblies  were  bent  but  remained 
attached  to  their  support  tubes.  With  the  support  tubes  positioned  vertically,  the  right 
rudder  pedal  pivot  lug  at  the  captain’s  position  was  bent  forward  and  downward,  but  the 
right  rudder  pedal  pivot  lug  at  the  first  officer’s  position  was  bent  forward  and  upward. 

1.16.5.2  Tests  to  Determine  the  Effects  of  Rudder  Cable  External  Forces, 
Breaks,  and  Blocked  Input  Linkage 

The  Safety  Board  used  an  out-of-service  737-200  for  a  series  of  flight  control 
system  tests  that  examined  the  effects  that  external  (nonsystem)  inputs  to  the  rudder  cables 
from  within  the  airplane’s  cargo  compartment  and  rudder  cable  separations  would  have 
on  the  rudder.  All  tests  were  conducted  on  the  ground  (with  no  aerodynamic  loads).  CVR 
equipment  similar  to  that  on  the  USAir  flight  427  airplane  was  installed  on  the  test  airplane. 

To  examine  the  effects  of  pressure  applied  to  the  rudder  cable  from  within  the  cargo 
compartment  (possibly  from  a  passenger  stepping  through  a  soft  spot  in  the  cabin  floor), 
incremental  loads  of  between  50  and  250  pounds  were  applied  vertically  to  the  rudder 
cables  within  the  forward  cargo  compartment,  and  the  rudder  deflection  was  measured.  The 
testing  showed  that  a  maximum  rudder  deflection  of  3.2°  was  measured  when  a  250-pound 
force  was  applied  to  the  left  rudder  cable;  all  other  test  conditions  (lesser  loads  and  the  right 
rudder  cable)  resulted  in  rudder  deflections  of  no  more  than  2.3°. 


The  maintenance  records  for  the  USAir  flight  427  airplane  indicated  that  a  temporary  patch  had  been 
made  to  the  floor  above  an  area  of  the  rudder  cable.  Thus,  the  testing  attempted  to  simulate  an  outside  force 
from  above  the  patched  area  that  could  have  deflected  the  rudder  cable. 
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To  examine  the  effects  on  the  rudder  system  of  rudder  cable  separations,  the  rudder 
cables  in  the  test  airplane  were  cut,  and  the  rudder  system  responses  (sounds  and  rudder 
pedal  and  rudder  surface  movement)  were  recorded.  A  cable  was  cut  during  two  tests 
(under  light  and  no  load  conditions  at  two  different  locations  within  the  fuselage),  and  the 
rudder  cable  was  replaced  between  test  conditions.  The  first  cable  cut  was  performed  at 
fuselage  station  360*^^  with  no  pressure  on  the  rudder  pedals.  A  loud  “bang”  was  recorded 
by  the  CVR  when  the  cable  was  cut,  but  no  rudder  pedal  or  rudder  surface  movement 
resulted.  The  second  cable  cut  was  performed  at  fuselage  station  259.5'^’  with  the  pilot’s 
feet  resting  lightly  on  the  rudder  pedals.  Another  “bang”  was  recorded  by  the  CVR  when 
the  cable  was  cut,  and  no  rudder  surface  movement  resulted.  However,  the  left  rudder 
pedal,  which  corresponded  to  the  cut  cable,  moved  to  the  -5°  position.  In  both  cable 
separation  conditions,  normal  leg  force  applied  to  the  rudder  pedals  after  the  cable  cut 
resulted  in  the  rudder  pedal  connected  to  the  cut  cable  moving  to  the  floor,  but  the  rudder 
pedal  attached  to  the  uncut  cable  maintained  the  ability  to  move  the  rudder  surface  in  the 
direction  of  the  intact  cable. 

The  Safety  Board’s  review  of  the  sounds  recorded  by  the  CVR  during  the  rudder 
cable  separation  tests  revealed  that  the  sounds  generated  by  cutting  the  rudder  cables  were 
impulsive  and  had  energy  that  was  distributed  throughout  the  frequency  spectrum. 
Another  characteristic  of  the  sounds  recorded  during  the  tests  was  the  multiple  secondary 
signals  that  appeared  to  be  the  result  of  mechanical  “ringing”  of  the  rudder  cable  system. 
The  unknown  thump  sounds  recorded  by  the  CVR  during  the  upset  of  flight  427  (see 
section  1.16.7.1)  were  in  the  low-frequency  (below  500  Hz)  range  only  and  exhibited  no 
“ringing”  or  secondary  signals. 

Other  tests  were  conducted  to  determine  the  effects  on  the  rudder  system  of  the 
presence  of  a  foreign  object  or  blockage  between  the  main  rudder  PCU  external  input 
crank  and  one  of  the  PCU  external  manifold  stops.  Figure  13  shows  the  locations  of  the 
737’s  external  manifold  stops.  Safety  Board  investigators  inserted  a  business  card  (folded 
three  times)  between  the  manifold  body  stop  and  the  input  crank  arm  and  observed  the 
effect  of  this  blockage  on  yaw  damper  and  rudder  pedal  inputs. 

The  tests  indicated  that,  when  the  input  crank  arm’s  movement  was  blocked  at  the 
aft  stop,  a  sustained  left  yaw  damper  command  caused  the  rudder  to  travel  to  its  full  left 
deflection.  The  test  also  showed  that,  when  the  blockage  was  positioned  at  the  forward 
side  of  the  external  input  crank,  a  sustained  right  yaw  damper  command  caused  the  rudder 
to  travel  to  a  full  right  rudder  deflection.  When  the  yaw  damper  command  was  sustained, 
the  movement  in  either  direction  could  not  be  stopped  until  the  blocking  material  was 
removed  from  its  position  between  the  manifold  stop  and  the  external  input  crank;  yaw 
damper  (or  rudder  pedal)  input  opposite  the  direction  of  rudder  movement  tended  to  keep 
the  blockage  in  place.  When  the  yaw  damper  input  command  was  stopped,  the  rudder 


Fuselage  station  360  is  located  near  seat  row  5  in  the  cabin;  maintenance  records  for  the  accident 
airplane  indicated  that  a  soft  interim  floor  panel  repair  was  accomplished  in  this  location. 

Fuselage  station  259.5  was  selected  for  the  cable  cut  test  because  that  location  allowed  easy  control 
cable  access. 
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Figure  13.  Locations  of  Boeing  737  main  rudder  PCD  external  manifold  stops. 

surface  returned  to  neutral.  In  some  tests,  yaw  damper  or  rudder  pedal  input  in  the 
direction  of  the  rudder  movement  dislodged  the  blockage,  and  normal  rudder  control  was 
regained. 

Examination  of  the  main  rudder  PCU,  as  installed  in  an  in-service  737  airplane, 
revealed  that  the  PCU  linkage  was  positioned  so  that  it  prevented  a  foreign  object  from 
dropping  into  the  space  between  the  aft  stop  and  the  crank  arm.  The  PCU’s  orientation 
would  also  make  it  difficult  for  a  foreign  object  to  lodge  between  the  forward  stop  and 
input  link.  The  external  summing  lever  effectively  covers  the  gap  in  the  PCU  retract 
direction  (left  rudder  command). 

1.16.5.3  Examination  and  Testing  of  Standby  Rudder 

1.16.5.3.1  Metailurgicai  Examination  of  Standby  Rudder  Components 

The  Safety  Board  conducted  a  metallurgical  examination  of  US  Air  flight  427 ’s 
standby  rudder  actuator  input  shaft,  bearing,  and  thrust  bearing  race  in  its  materials 
laboratory  in  Washington,  D.C.  Initial  examination  of  the  components  revealed  the  effects 
of  galling.  The  input  shaft  exhibited  two  areas  of  material  buildup  on  the  lubricated  land 
surface  on  the  inboard  side  of  the  shaft’s  Teflon  seal.  The  bore  of  the  bearing  in  which  the 
shaft  turns  contained  two  shallow  cavity  areas  corresponding  in  orientation,  size,  and 
shape  to  the  two  areas  on  the  shaft  that  contained  the  material  buildup,  and  the  thrust 
bearing  race  exhibited  a  non-uniform  roller  contact  pattern. 

Energy  dispersive  x-ray  spectrum  (EDS)  analyses  were  performed  on  the  input 
shaft  and  the  bearing.  According  to  a  Safety  Board  metallurgist,  EDS  performed  on  the 
surface  of  the  input  shaft  in  an  area  not  affected  by  the  galling  produced  a  spectrum 
consistent  with  the  type  440C  stainless  steel  specified  for  the  input  shaft.  However,  the 
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metallurgist  stated  that  EDS  performed  on  the  bearing  bore  and  the  galled  areas  of  the 
shaft  generated  spectra  that  were  consistent  with  the  type  416  stainless  steel  specified  for 
the  bearing.  Measurements  of  the  accident  airplane’s  standby  rudder  actuator  components 
were  within  the  engineering  drawing  specifications. 

1.16.5.3.2  Standby  System  Actuator  Binding/Jam  Tests 

Safety  Board  investigators  conducted  tests  on  the  rudder  system  of  a  737  to 
examine  the  effects  of  variable  input  shaft  binding  forces  and  input  shaft  binding  at 
different  positions,  with  and  without  yaw  damper  input  and  various  hydraulic  system 
failures.  Before  testing,  the  investigators  verified  that  the  airplane’s  rudder  system  rigging 
and  main  and  standby  rudder  PCU  installations  met  in-service  standards;  the  investigators 
also  cycled  the  rudder  systems  to  verify  instrumentation  and  operational  limits  and 
establish  a  baseline.  The  standby  rudder  actuator  was  removed  from  the  test  airplane  and 
replaced  with  a  standby  rudder  actuator  that  was  selected  for  the  testing  because  it 
exhibited  input  shaft  and  bearing  galling  similar  to  the  unit  that  was  installed  on  the  USAir 
flight  427  accident  airplane. 

The  following  rudder  commands  were  input  with  the  main  and  standby  rudder 
PCUs  pressurized:'^®  full  rudder  pedal  inputs  in  both  directions  with  the  yaw  damper 
disengaged,  full  rudder  pedal  inputs  in  both  directions  with  the  yaw  damper  engaged,  and 
full  yaw  damper  commands  in  both  directions.  In  all  of  these  tests,  the  rudder  system 
functioned  normally,  and  higher-than-normal  pilot  rudder  pedal  forces  were  not 
required.'^' 

After  these  tests,  the  standby  rudder  actuator  was  replaced  with  one  that  had  an 
input  shaft  that  could  be  adjusted  to  various  levels  of  binding  (intended  to  simulate 
galling).  The  replacement  actuator  was  used  to  determine  the  effects  of  binding  of  the 
standby  rudder  input  shaft  and  bearing  and  the  various  levels  of  force  that  would  be 
required  to  overcome  such  binding.  Tests  were  conducted  with  the  actuator  adjusted  so 
that  60  to  70  and  100  pounds  of  force  were  required  to  move  the  actuator  input  arm.  The 
tests  also  measured  the  effects  of  left,  right,  and  no  yaw  damper  commands. 

The  tests  showed  that,  with  60  to  70  pounds  of  standby  rudder  binding  force,  the 
rudder  could  travel  T  to  the  left  with  a  full  left  yaw  damper  command  and  8°  to  the  right 
with  a  full  right  yaw  damper  command.  With  100  pounds  of  standby  rudder  binding  force, 
the  rudder  could  travel  8°  to  the  left  and  right  with  full  left  and  right  yaw  damper 
commands,  respectively.'^^  Test  conditions  that  simulated  hydraulic  system  failures,  along 
with  binding  of  the  standby  actuator,  did  not  significantly  affect  the  rudder  system’s 


The  standby  and  main  rudder  PCU  input  rods  move  together  regardless  of  which  PCU  is  pressurized. 

According  to  Boeing,  normal  input  force  is  about  0.5  pounds. 

The  737-300  yaw  damper  still  commanded  ±  3°  of  motion.  Therefore,  if  the  standby  actuator 
jammed  when  the  rudder  was  positioned  3°  left  of  its  neutral  position,  the  yaw  damper  could  command 
rudder  movement  3°  in  either  direction,  resulting  in  left  rudder  movement  to  6°  of  left,  or  right  deflection 
back  to  neutral.  If  the  rudder  was  at  6°  left  when  the  standby  actuator  binding  occurred,  the  yaw  damper 
could  command  rudder  movement  that  would  result  in  between  3  and  9°  of  left  rudder  deflection. 
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operation.  Ergonomic  research  indicates  that  pilots  should  have  no  difficulty  applying  80 
to  100  pounds  of  leg-pushing  force  against  the  rudder  pedal,  thus  overriding  the  effect  of 
such  standby  rudder  actuator  binding.  (For  additional  information  regarding  ergonomic 
research  on  pilot  rudder  pedal  forces,  see  section  1.18.8.) 

Tests  were  also  conducted  to  determine  the  effects  of  a  hard  jam  (not  just  binding) 
of  the  standby  rudder  actuator  input  shaft  and  bearing  at  the  neutral,  3°  (simulating  left  and 
right  yaw  damper  inputs),  and  maximum  standby  rudder  actuator  positions  (limited  by  the 
main  rudder  PCU  external  manifold  stop).  The  tests  showed  that,  with  the  standby  rudder 
actuator  input  shaft  jammed  at  the  neutral  position,  the  rudder  could  travel  6°  to  the  left 
and  4°  to  the  right  with  respective  full  yaw  damper  commands.  A  force  of  45  pounds  on 
the  left  rudder  pedal  or  55  pounds  on  the  right  rudder  pedal  would  return  the  rudder  to  the 
neutral  position;  when  the  yaw  damper  command  was  turned  off,  the  rudder  remained  at 
neutral. 


When  the  standby  rudder  actuator  input  shaft  was  jammed  at  the  3°  left  position, 
the  rudder  could  travel  10°  to  the  left  with  a  full  left  yaw  damper  command  and  3°  to  the 
right  with  a  full  right  yaw  damper  command.  With  the  yaw  damper  at  its  full  deflection,  a 
force  of  95  pounds  or  25  pounds  on  the  appropriate  rudder  pedal,  respectively,  would 
return  the  rudder  to  the  neutral  position.  When  the  yaw  damper  was  turned  off,  the  rudder 
was  positioned  2°  left  of  the  neutral  position 

When  the  standby  rudder  actuator  input  shaft  was  jammed  at  the  3°  right  position, 
the  rudder  could  travel  2°  to  the  left  with  a  full  left  yaw  damper  command  and  13°  to  the 
right  with  a  full  right  yaw  damper  command.  With  the  yaw  damper  at  its  full  deflection,  a 
force  of  30  or  110  pounds  on  the  appropriate  rudder  pedal,  respectively,  would  restore  the 
rudder  to  the  neutral  position.  When  the  yaw  damper  was  turned  off,  the  rudder  was 
positioned  4°  to  the  right  of  the  neutral  position. 

With  the  standby  rudder  actuator  input  shaft  jammed  at  a  position  required  for  a 
full  maximum  rate  left  rudder  input  (limited  by  the  main  rudder  PCU  external  manifold 
stop),  the  rudder  traveled  19°  to  the  left  of  the  neutral  position.  Under  this  test  condition, 
65  pounds  of  force  applied  to  the  right  rudder  pedal  returned  the  rudder  to  the  neutral 
position.  The  65-pound  force  to  the  right  rudder  pedal  would  create  a  140-pound  force  on 
the  standby  PCU  input  arm. 

Regardless  of  whether  the  standby  rudder  actuator  input  shaft  was  jammed  at 
3°  left  or  3°  right  of  the  neutral  position  or  at  the  main  rudder  PCU  body  stop  in  either 
direction,  the  rudder  moved  to  an  off-neutral  position  when  the  hydraulic  system  was 
powered.  With  the  standby  rudder  actuator  input  shaft  and  bearing  jammed  at  the  neutral 
position,  no  initial  offset  to  the  rudder  occurred.  In  every  case,  the  rudder  could  be 
centered  by  applying  rudder  pedal  force  to  oppose  the  offset. 

The  replacement  standby  actuator  contained  an  input  shaft  and  bearing  that 
displayed  galling  similar  to  the  unit  that  was  installed  in  the  United  flight  585  airplane. 
Subsequent  testing  indicated  that  a  full  3°  yaw  damper  command  would  result  in  a 
5°  rudder  movement  to  the  left  and  a  6°  rudder  movement  to  the  right.  Another  galled 
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input  shaft  and  bearing  were  installed  in  the  standby  rudder  actuator,  and  subsequent  tests 
indicated  that  full  3°  yaw  damper  commands  to  the  left  and  right  resulted  in  6°  of  rudder 
movement  in  the  respective  directions. 

1.16.5.4  Detailed  Examinations  and  Tests  of  Main  Rudder  PCUs 
1.16.5.4.1  Detailed  Examinations  of  Main  Rudder  PCU  Servo  Valves 

Several  times  during  this  investigation,  the  Safety  Board  subjected  the  USAir 
flight  427  PCU'-'*^  to  Parker’s  postproduction  acceptance  test  procedure  (which  is  a 
performance-based  test  only  and  does  not  require  the  measurement  of  diametrical 
clearances).  The  acceptance  tests  did  not  reveal  any  disqualifying  anomalies.  To  determine 
the  diametrical  clearances  that  existed  within  the  USAir  flight  427  PCU  servo  control 
valve  slides  and  clarify  the  variability  of  clearances  that  passed  the  acceptance  tests,  the 
Safety  Board  measured  the  clearances  between  the  primary  and  secondary  slides  and 
between  the  secondary  slide  and  the  servo  valve  housing  on  three  PCU  servo  valves — a 
new-production  PCU  servo  valve  and  the  PCU  servo  valves  from  the  USAir  flight  427  and 
Eastwind  flight  517  airplanes. The  primary  and  secondary  slides  and  the  servo  valve 
housing  of  each  PCU  were  measured  in  three  places — at  the  input  lever  end,  midpoint,  and 
spring  end  (see  figure  10).  Table  3  lists  the  minimum  diametrical  clearances  (in  inches) 
measured  for  each  PCU  at  each  position. 


Table  3.  Diametrical  clearance  measurements  (in  inches)  for  three  PCUs. 


Measurement 

position 

427  PCU 
slide  to 
housing 

427  PCU 
slide  to 
slide 

517  PCU 
slide  to 
housing 

517  PCU 
slide  to 
slide 

New  PCU 
slide  to 
housing 

New  PCU 
slide  to 
slide 

Input  lever  end 

0.000130 

0.000170 

0.000190 

0.000200 

0.000195 

0.000190 

Midpoint 

0.000140 

0.000140 

0.000170 

0.000180 

0.000215 

0.000200 

Spring  end 

0.000170 

0.000150 

0.000180 

0.000190 

0.000190 

0.000210 

As  part  of  its  investigation,  the  Safety  Board  conducted  further  detailed 
examination  and  testing  of  the  main  rudder  PCU  servo  valves  from  USAir  flight  427, 
Eastwind  flight  517,  and  United  flight  585.  The  Safety  Board  also  examined  a  “minimum 
tolerance”  servo  valve  that  was  used  by  Boeing  during  thermal  shock  testing  (see  section 
1.16.5.4.7);'^^  new-production  servo  valves;  the  servo  valve  from  the  Silk  Air  flight  185 
accident  in  Palembang,  Indonesia; and  five  servo  valves  supplied  by  Parker  that  had 
been  removed  from  service  and  had  varying  hours  of  operation  (referred  to  as  exemplar 
valves).  The  Safety  Board’s  materials  laboratory  examined  the  primary  and  secondary 


Postaccident  tests  and  examinations  were  performed  on  the  USAir  flight  427  main  rudder  PCU  servo 
valve  and  the  primary  and  secondary  slides  in  their  condition  as  recovered.  The  PCU  actuator  rod  and 
external  input  linkage,  however,  exhibited  impact  damage  that  precluded  normal  operation;  thus,  these 
components  (and  their  associated  hardware)  were  replaced  to  facilitate  testing. 

It  was  not  possible  to  measure  the  clearances  that  existed  within  the  PCU  servo  valve  from  United 
flight  585  because  the  valve  was  damaged  by  the  postaccident  fire  and  attempts  to  remove  the  PCU  from  the 
wreckage. 
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slides  and  housing  from  each  of  these  main  rudder  PCU  servo  valves*^"^  using  a  specially 
designed  borescope  and  video  recording  system.  Each  segment  of  the  primary  and 
secondary  slides’  outside  diameter  surfaces,  the  metering  ports, and  the  inside  diameters 
of  the  secondary  slide  and  the  servo  valve  housing  were  examined  with  a  90°  borescope  at 
magnifications  up  to  130  times.  The  outside  diameter  surfaces  of  the  primary  and 
secondary  slides  were  also  examined  with  a  binocular  microscope. 

A  few  small  chipped  areas  were  noted  on  the  metering  edges  of  the  primary  slide 
of  each  of  the  units  examined;  the  locations  of  the  chipped  areas  did  not  correspond 
circumferentially  to  the  metering  port  areas.  Examination  with  a  scanning  electron 
microscope  (SEM)  revealed  that  the  dimensions  of  the  largest  chipped  area  on  the  USAir 
flight  427  primary  slide  was  0.006  inch  in  circumference  by  0.002  inch  in  length.  The 
other  primary  slides  examined  (including  the  new-production  servo  valve  primary  slide) 
had  chipped  areas  of  similar  or  larger  size  yet  still  met  specifications. 

The  metering  ports  for  the  secondary  slide  and  the  servo  valve  housing  inside 
diameter  surfaces  were  also  examined  using  a  15°  borescope  so  that  the  metering  port 
edges  could  be  better  viewed.  No  evidence  of  deformation  or  distress  was  noted  on  any  of 
the  metering  ports  on  any  of  the  secondary  slides  and  servo  valve  housings. 

In  addition,  small  deposits  of  material  that  appeared  to  have  the  same  composition 
as  the  secondary  slide  were  observed  on  the  slide’s  outside  diameter  surface  adjacent  to 
the  metering  edge.  To  identify  the  origin  of  these  material  smears,  the  Safety  Board 
reviewed  Parker’s  manufacturing  procedures.  This  review  found  that,  during  manufacture, 
the  servo  valve  slides  are  trimmed  (or  cut)  at  the  metering  edges,  burr-wiped  (or  polished), 
and  functionally  tested  in  matched  assemblies.  The  Safety  Board  obtained  from  Parker 


This  servo  valve  was  specifically  selected  from  existing  stock  because  it  had  the  tightest  tolerances 
between  the  primary  and  secondary  slides  and  the  secondary  slide  and  the  servo  valve  housing  that  would 
pass  the  PCU  acceptance  test  friction  requirements.  According  to  Boeing,  the  diametric  clearance  between 
the  secondary  slide  and  the  servo  valve  housing  was  0.000070  inch.  (The  same  clearance  in  the  USAir  flight 
427  valve  was  0.000130  inch.) 

The  December  19,  1997,  accident  involving  Silk  Air  flight  185,  a  737-300,  9V-TRF,  had  not,  as  of 
March  1999,  revealed  any  evidence  that  the  accident  was  related  to  a  rudder  anomaly.  The  airplane  was  en 
route  from  Jakarta,  Indonesia,  to  Singapore  when  it  disappeared  from  the  ATC  radar  screen  at  35,000  feet 
msl  and  crashed  at  the  mouth  of  a  river  about  33  miles  northeast  of  Palembang.  The  Safety  Board  is 
participating  in  the  Indonesian  government’s  ongoing  accident  investigation  under  the  provisions  of  Annex 
13  to  the  Convention  on  International  Civil  Aviation.  The  airplane’s  CVR  and  FDR  were  evaluated  by  the 
Safety  Board’s  laboratory  in  Washington,  D.C.  That  evaluation  revealed  that  both  had  stopped  recording 
before  the  airplane  disappeared  from  the  radar  screen.  (The  CVR  stopped  recording  first  and  the  FDR 
stopped  recording  about  6  minutes  later,  1  minute  14  seconds  before  the  airplane’s  last  radar  return  was 
recorded.)  The  recorded  data  indicated  no  problems  with  the  airplane  or  unusual  comments  by  the  flight 
crew. 

The  main  rudder  PCU  from  the  Silk  Air  accident  airplane  was  examined  by  Safety  Board 
investigators  under  the  supervision  of  a  representative  from  the  Indonesian  government.  The  examination 
did  not  reveal  any  evidence  of  a  preimpact  jam  or  failure. 

Metering  ports  are  rectangular  holes  in  the  servo  valve  housing  and  secondary  slide  through  which 
hydraulic  fluid  flows  to  cause  actuation  of  the  unit.  Metering  edges  are  the  sides  of  grooves  that  are  cut  into 
the  outside  diameter  surface  of  the  primary  and  secondary  slides.  Flow  of  hydraulic  fluid  is  controlled  by 
positioning  the  metering  edges  relative  to  the  metering  ports. 
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two  primary  slides  in  an  intermediate  manufacturing  condition  to  microscopically  observe 
the  trimmed  and  trimmed/burr-wiped  conditions.  SEM  examination  of  the  trimmed-only 
primary  slide  revealed  numerous  pieces  of  folded-over  metal  curled  over  the  metering 
edge  at  the  trimmed  edge  of  the  slide.  SEM  examination  of  the  trimmed  and  burr-wiped 
primary  slide  showed  areas  on  the  slide’s  outside  diameter  adjacent  to  the  trimmed  edge 
that  appeared  to  be  flattened  down  and  smoothed  over,  similar  to  that  observed  on  the 
USAir  flight  427  primary  slide. 

1 .1 6.5.4.1 .1  Examination  of  Exempiar  Servo  Valves  for  White  Layer 

As  discussed  in  section  1.16.5.4.1,  the  five  servo  valves  supplied  by  Parker  that 
had  been  removed  from  service  were  referred  to  as  exemplar  servo  valves.  During 
manufacture,  the  outside  diameter  surfaces  of  the  primary  and  secondary  slides  in  the 
servo  valve  were  nitrided  (impregnated  with  nitrogen  to  increase  hardness).  The  nitriding 
process  can  produce  a  brittle  surface  layer,  referred  to  as  a  “white  layer.”  The  Safety  Board 
considered  whether  such  a  layer,  if  it  remained  after  the  manufacturing  process,  could 
have  provided  chips  that  could  cause  jamming  of  the  unit.  Parker  reported  that  the 
thickness  of  the  white  layer  created  during  nitriding  is  monitored  by  cutting  into  samples 
and  that  the  manufacturing  process  removes  an  amount  of  material  from  the  outside 
diameter  surface  that  is  far  greater  than  the  typical  thickness  of  the  white  layer.  Also,  the 
grooves  in  the  primary  and  secondary  slides  are  cut  after  the  parts  are  nitrided,  preventing 
the  accumulation  of  the  white  layer  at  the  comer  between  the  grooves  and  outside 
diameter  surfaces.  The  Safety  Board’s  materials  laboratory  cross-seetioned  the  five 
exemplar  slides  and  found  no  white  layer  on  the  slides’  outside  diameter  surfaces  or 
within  the  grooves. 

1.16.5.4.2  PCU  Dynamic  Testing 

On  September  16  through  20,  1996,  the  Safety  Board  conducted  a  series  of  tests  to 
examine  the  effects  of  dynamic  external  loads  (such  as  those  that  the  USAir  flight  427 
airplane  might  have  experienced  during  the  wake  turbulence  encounter)  applied  axially  to 
the  main  rudder  PCU  actuator  rod.  These  tests,  conducted  on  a  new-production  PCU  and 
the  flight  427  PCU,’^^  included  the  following  test  conditions:  (1)  wake  encounter 
simulation  tests  (600-  and  1, 200-pound''^”  load  inputs  to  the  PCU  in  the  left  and  right 
rudder  directions  while  the  yaw  damper  was  cycling),  (2)  yaw  damper  hardover  tests 
(hardover  commands  input  coincident  with  600-  and  1,200-pound  loads  applied  to  the 
PCU  in  the  left  and  right  rudder  directions),  (3)  manual  rudder  input  with  no  yaw  damper 
input  (600-  and  1,200-pound  loads  applied  to  the  PCU  actuator  rod  in  the  left  and  right 
rudder  directions  coincident  with  manual  left  and  right  rudder  input  commands), 
(4)  manual  mdder  input  with  no  yaw  damper  input  but  with  hydraulic  system  pressurization 
failures,  and  (5)  a  3,500-pound  input  test  (performed  on  the  production  PCU  only).  Both 
PCUs  responded  normally  throughout  all  tests  without  any  abnormal  motions. 


The  PCU  from  United  flight  585  was  too  badly  damaged  to  test. 

The  main  rudder  PCU  output  rod  on  the  accident  airplane  might  have  been  subjected  to  a  load  as 
high  as  600  pounds  as  a  result  of  its  encounter  with  wake  turbulence  from  Delta  flight  1083;  the  Safety 
Board  doubled  that  load  to  1,200  pounds  for  the  dynamic  tests  to  establish  a  margin  of  confidence. 
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1.16.5.4.3  Tests  of  Hydraulic  Fluid 

During  on-site  and  reconstruction  activities  for  USAir  flight  427,  the  Safety  Board 
obtained  hydraulic  fluid  samples  from  the  accident  airplane’s  main  rudder  PCU  and  other 
portions  of  hydraulic  systems  A  and  B  for  further  examination.''^^  After  visual  inspection 
for  color  and  clarity,  a  small  portion  of  each  fluid  sample  was  analyzed  using  gas 
chromatography/mass  spectrometry*'^^  and  tested  for  moisture  content;  the  remaining  fluid 
was  filtered  for  contaminant  particle  counting  and  tested  for  acidity. 

The  tests  revealed  that  the  system  A  hydraulic  fluid  was  94  percent  Skydrol  LD4 
fluid  and  that  the  system  B  hydraulic  fluid  was  77  percent  Skydrol  LD4  fluid;  the 
remaining  percentage  in  both  systems  was  identified  as  Chevron  HyJet  fluid.  The  average 
system  moisture  content,  color  of  the  fluid,  and  average  system  acid  numbers  for  the  fluids 
in  both  systems  A  and  B  met  the  specifications  for  in-service  fluid  limits  in  Boeing 
Material  Specification  3-llJ,  dated  December  22,  1993.*'*^  Table  4  shows  those 
specifications. 


Table  4.  Boeing  Material  Specification  3-11 J  specifications  for  in-service  fluid  limits. 


Fluid  properties 

In-service  fluid  iimits 

Visua! 

Must  be  transparent.  No  phase  separation  or 
precipitation.  All  colors  are  satisfactory. 

Percent  of  water  by  weight 

0.1  to  0.8. 

Neutralization  (acid  No. — in  mg  KOH/gm) 

1.5  mg  KOH/gm  maximum. 

Table  5  shows  the  results  of  the  contaminant  particle  counting  tests  of  the 
hydraulic  fluid  in  one  sample  from  the  accident  airplane’s  PCU.  The  results  correspond  to 
NAS  1638  fluid  standards  for  Class  11.*'*^ 


Because  the  tests  showed  that  dynamic  loads  had  no  effect  on  PCU  operation,  the  tests  were  not 
repeated  on  the  Eastwind  PCU. 

Tests  performed  using  hydraulic  fluid  samples  from  the  USAir  flight  427  airplane  could  not  be 
conducted  in  accordance  with  standard  industry  practices  because  of  the  limited  volume  of  fluid  in  the 
samples  available.  According  to  NAS,  the  “fluid  sample  size  shall  be  proportional  of  the  total  volume  of 
fluid  contained  in  the  device  being  checked —  The  sampling  procedure  shall  provide  a  method  of  applying 
motion  to  the  item  being  checked  which  will  result  in  fluid  agitation  within,  so  that  a  reasonable  assumption 
shall  be  made  that  the  fluid  [sample]  will  be  representative  of  particle  dispersion  in  the  total  fluid  volume.” 
The  hydraulic  fluid  samples  from  the  accident  airplane  were  obtained  from  damaged  and  broken 
components  under  uncontrolled  circumstances,  and  it  is  possible  that  the  fluid  samples  did  not  represent  the 
true  contamination  level  of  the  hydraulic  fluid  in  the  system  before  the  accident. 

In  this  analysis  method,  a  mixture  of  compounds  is  separated  by  gas  chromatography,  and  the 
molecular  composition  of  each  is  determined  by  mass  spectrometry. 

According  to  this  document’s  Qualified  Products  List  for  hydraulic  fluid,  both  identified  fluids  were 
classified  by  Boeing  as  Class  1,  Grade  A  hydraulic  fluids  and  were  approved  for  use  in  737  hydraulic 
systems. 

As  previously  mentioned,  Boeing  ensures  that  the  hydraulic  fluid  particulate  count  of  newly 
delivered  airplanes  meet  the  NAS  1638  fluid  standards  for  Class  9.  Tests  conducted  on  hydraulic  fluid 
samples  from  the  Eastwind  flight  517  airplane  indicated  that  the  level  of  contaminants  in  that  fluid  was 
roughly  equivalent  to  the  NAS  1638  fluid  standards  for  Class  10,  which  permits  a  lower  number  and  smaller 
size  of  particles  than  Class  11  but  a  higher  number  and  larger  size  of  particles  than  Class  9. 
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Table  5.  Results  of  contaminant  particle  counting  tests. 


Particle  size 

5-15  n 

15-25  fi 

25-50  H 

50-100  n 

>100 

Hydraulic 
system  A 

482,116 

8,897 

1,328 

70 

6 

Hydraulic 
system  B 

489,510 

7,631 

733 

5 

0 

1.16.5.4.4  Tests  to  Determine  the  Effects  of  Silting 

The  primary  slide  metering  edges  are  “underlapped”  relative  to  the  secondary  slide 
metering  ports,  which  allows  a  certain  amount  of  hydraulic  fluid  circulation.  In  contrast, 
the  secondary  slide  metering  edges  are  “overlapped”  relative  to  the  servo  valve  housing 
metering  ports,  which  minimizes  hydraulic  fluid  flow.*"^^  Because  of  the  possibility  that 
the  fine,  subfiltration-size  particles  that  normally  circulate  through  the  hydraulic  system 
suspended  in  hydraulic  fluid  could  build  up  in  the  servo  valve  and  restrict  the  movement 
of  the  secondary  slide,  the  Safety  Board  conducted  tests,  using  hydraulic  fluid  from  an 
in-service  737,*"^^  to  determine  if  such  a  buildup  (or  silting) within  the  PCU  could  result 
in  a  jam  of  the  PCU  servo  valve  primary  or  secondary  slides  or  an  increase  in  sliding  force 
to  cause  an  anomalous  rudder  command.  The  USAir  flight  427  PCU  external  input  crank 
was  rigidly  fixed  (pinned  in  position),  which  prevented  the  PCU  servo  valve  from  moving 
off  its  neutral  position.  Hydraulic  pressure  was  applied  to  the  PCU  in  its  neutral  position 
for  about  1.2  hours  to  allow  silting  to  occur.  The  pin  was  then  removed. 

The  external  input  crank  did  not  move  after  it  was  released.  (According  to  Boeing 
representatives,  a  servo  valve  bias  spring  normally  allows  the  external  input  crank  to  move 
toward  the  retract  direction  when  the  external  input  crank  is  not  fixed.)  A  force  of 


When  the  primary  slide  is  in  its  neutral  position  relative  to  the  secondary  slide,  the  axial  position  of 
the  metering  edges  on  the  primary  slide  falls  short  (typically  by  0.001  to  0.002  inch)  of  closing  off  the 
secondary  slide  metering  ports.  This  shortfall  allows  for  some  hydraulic  fluid  to  continually  circulate 
throughout  the  area.  The  amount  of  hydraulic  system  A  fluid  flowing  through  the  servo  valve  when  it  is  not 
in  motion  varies  from  300  cc/min  in  a  new  servo  valve  up  to  3,000  cc/min  in  an  old  servo  valve.  The 
hydraulic  system  B  (including  yaw  damper)  fluid  flows  through  the  servo  valve  at  1,370  cc/min. 

When  the  secondary  slide  is  in  its  neutral  position  relative  to  the  servo  valve  housing,  the  metering 
edges  of  the  secondary  slide  extend  axially  beyond  (typically  by  0.001  to  0.002  inch)  the  edges  of  the  servo 
valve  housing  metering  ports,  completely  covering  the  metering  ports  and  restricting  hydraulic  fluid  flow. 
However,  a  small  amount  of  hydraulic  fluid  leakage  occurs  around  the  metering  ports  through  the 
diametrical  clearance  between  the  secondary  slide  and  the  servo  valve  housing. 

At  the  beginning  of  the  testing,  the  hydraulic  fluid  used  met  the  hydraulic  fluid  cleanliness  limits  in 
NAS  1638  standard  for  class  10  fluid.  At  the  end  of  the  testing,  the  fluid  met  the  limits  for  class  12.  (See 
table  2  for  permissible  contaminant  ranges  for  selected  fluid  classes.) 

The  term  “silting”  refers  to  the  accumulation  of  particles  of  contaminants  in  hydraulic  fluid  in  a 
hydraulic  component.  The  particles  are  smaller  than  the  filter  on  the  inlet  side  of  the  component  and  tend  to 
settle  at  various  edges  and  corners  of  valves  and  stay  there  unless  washed  away  by  higher  flow  rates.  In  other 
words,  when  the  servo  valve  is  in  the  hydraulically  neutral  position,  the  flow  of  hydraulic  fluid  is  restricted, 
and  the  servo  valve  can  function  as  a  filter  by  catching  some  of  the  particles.  These  particles  tend  to 
accumulate  at  the  upstream  side  of  edges  and  corners  of  narrow  orifices  (such  as  the  servo  valve  ports); 
however,  movement  of  the  servo  valve  from  the  hydraulically  neutral  position  results  in  increased  hydraulic 
fluid  flow,  which  tends  to  flush  any  accumulated  particles  through  the  servo  valve. 
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4  pounds  was  required  to  move  the  external  input  crank.  Normal  input  crank  operation 
requires  about  1.5  pounds  of  force. 

1.16.5.4.5  PCU  Servo  Valve  Chip  Shear  Tests 

The  Safety  Board  conducted  two  series  of  tests  to  determine  if  a  chip  of  material 
could  lodge  between  the  PCU  servo  valve  primary  and  secondary  slides  or  between  the 
secondary  slide  and  the  valve  housing  and  result  in  a  jammed  servo  valve.  The  first  series 
of  tests  were  conducted  at  Boeing’s  Equipment  Quality  Analysis  Laboratory  in  January 
1995  with  chips  of  various  materials  that  could  be  found  in  an  airplane  system.  These 
materials  included  rubber,  Teflon,  steel  wire,  aluminum  alloys,  hardened  and  stainless 
steels,  lockwire,  aluminum-nickel-bronze,  and  chrome  plating.  The  chip  sizes  were 
manufactured  so  they  would  be  large  enough  to  fill  as  much  as  possible  of  the  0.015-  by 
0.045-inch  primary  metering  ports.  Chips  were  inserted  into  these  metering  ports  at  the 
interface  of  the  primary  and  secondary  slides  of  a  servo  valve  slide  assembly.  The  primary 
slide  was  then  moved  to  close  off  the  metering  port. 

The  tests  demonstrated  that,  when  forces  of  up  to  44  pounds  were  applied’^®  to 
move  the  primary  slide  to  close  off  the  secondary  slide  metering  ports,  all  but  one  type  of 
chip  sheared.  The  chip  that  did  not  shear  was  a  hardened-steel  chip  that  jammed  the 
primary  slide  to  the  secondary  slide  and  did  not  shear  with  the  maximum  force  of  44 
pounds  applied.’^'  When  investigators  examined  the  servo  valve  after  the  primary  slide 
jammed  on  the  hardened-steel  chip,  they  noted  a  physical  mark  on  the  surface  of  the 
primary  slide  where  the  chip  was  inserted.  The  physical  mark  had  the  approximate  size 
and  shape  of  the  hardened-steel  chip. 

A  second  series  of  chip  shear  tests  was  conducted  at  Boeing’s  facility  in  Everett, 
Washington,  in  February  1997.  These  chip  shear  tests  were  similar  to  the  January  1995 
tests  except  that  (1)  the  February  1997  test  chips  were  inserted  in  the  secondary  metering 
ports  at  the  interface  of  the  secondary  slide  to  the  servo  valve  housing,  (2)  different  sizes 
of  hardened-steel  chips  were  used  and  (3)  forces  of  up  to  140  pounds  were  applied.  In  the 
February  1997  tests,  all  of  the  chips  were  successfully  sheared,  and  each  shearing  event 
created  a  mark  on  the  secondary  slide  that  was  approximately  the  shape  of  the  chip.  The 
maximum  shear  force  needed  was  140  pounds  for  a  0.042-inch  wide  by  0.014-inch  thick 
chip.  The  minimum  shear  force  for  the  same  material  was  23  pounds  for  a  0.011-inch  wide 
by  0.013-inch  thick  chip. 

1.16.5.4.6  PCU  Tests  Conducted  to  Determine  the  Effects  of  Air  in 
the  Hydraulic  Fluid 

To  determine  the  effects  that  air  in  the  hydraulic  fluid  would  have  on  the  main 
rudder  PCU  operation,  the  Safety  Board  conducted  operational  tests  in  August  1996  of  the 
USAir  flight  427  PCU.  During  these  tests,  nitrogen  was  introduced  into  the  system  A 


According  to  Boeing,  the  PCU  design  allows  a  maximum  input  force  of  about  50  pounds  to  the 
primary  slide  and  200  pounds  to  the  secondary  slide. 

This  chip  was  0.032  to  0.058  inch  wide  by  0.012  to  0.016  inch  thick. 
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hydraulic  fluid,  upstream  of  the  PCU.  (Gaseous  nitrogen  was  used  to  simulate  air  for  these 
tests.)  Tests  were  conducted  with  manual  inputs  at  the  external  input  crank  with  a  cyclic 
yaw  damper  input  (hydraulic  system  A  pressure  off  with  a  sustained  0.3-Hz'^^  cyclic 
damper  input,  hydraulic  system  B  pressure  off  with  a  sustained  0.3-Hz  cyclic  yaw  damper 
input,  and  a  ±  3°  stepped  yaw  damper  command  in  each  direction).  The  PCU  responded 
normally  (the  output  command  matched  the  input  command)  during  these  tests. 

1.16.5.4.7  PCU  Thermal  Testing 

A  hydraulic  system  thermal  analysis  by  Boeing  engineers  indicated  that  the  failure 
of  one  of  the  737  airplane’s  EDPs  could  result  in  the  overheating  of  the  fluid  in  one  of  the 
hydraulic  systems.  Further,  in  response  to  recommendations  made  by  an  independent 
technical  advisory  panel, the  Safety  Board  conducted  two  series  of  thermal  tests  (in 
August  and  October  1996)'^'*  to  identify  the  effects  of  thermal  variations  on  the  operation 
of  the  main  rudder  PCU.  The  hydraulic  fluid  used  in  the  Safety  Board’s  silting  tests  was 
used  for  both  series  of  thermal  tests.'^^ 

During  the  August  1996  thermal  tests,  a  total  of  12  tests  were  conducted:  4  on  a 
new-production  PCU  and  8  on  the  US  Air  flight  427  PCU.  During  the  October  1996 
thermal  tests,  a  total  of  19  tests  were  conducted:  8  on  the  new-production  PCU  and  11  on 
the  USAir  flight  427  PCU.  The  tests  for  both  series  were  conducted  first  on  the  new- 
production  PCU  (to  verify  setup  and  methodology)  and  then  on  the  USAir  flight  427  PCU. 
Testing  under  all  of  the  thermal  test  conditions  was  accomplished  by  pushing  or  pulling 
the  external  PCU  input  crank  with  a  rod  (simulating  a  left  or  right  input  command)  and 
using  sufficient  force  to  move  the  secondary  slide.  (In  the  absence  of  jamming  or  binding, 
the  secondary  slide  moves  when  about  12  pounds  of  force  is  applied  at  the  input  crank.) 

The  results  of  three  thermal  test  conditions  (performed  on  both  PCUs  during  both 
the  August  and  October  1996  test  series)  are  discussed  in  this  report  section.  Two  of  these 
test  conditions  were  included  in  this  section  because  the  tests  and  their  results  were 
representative  of  all  other  thermal  tests  that  were  conducted  under  conditions  believed  at 
the  time  to  approximate  those  that  a  737  airplane  might  encounter  during  normal  operation 
(baseline  and  with  a  hydraulic  system  failure).  The  third  test  condition,  which  used  hot 
hydraulic  fluid  injected  directly  into  a  cold  PCU  to  explore  the  effects  of  extreme 
temperature  differentials  on  the  main  rudder  PCU’s  operation,  was  selected  for  inclusion 


0.3  Hz — about  1  cycle  every  3+  seconds — approximates  the  airplane’s  nominal  dutch  roll  frequency 
and  corresponding  yaw  damper  output  to  dampen  dutch  roll. 

The  independent  technical  advisory  panel  was  created  by  the  Safety  Board  in  January  1996  to  review 
the  work  of  the  Safety  Board’s  Systems  Group.  See  section  1.18.2  for  more  information  about  the  panel. 

The  October  1996  tests  used  improved  temperature  control  and  data  recording  capabilities.  For 
additional  information  regarding  thermal  tests,  see  “Systems  Group  Chairman’s  Factual  Report  of 
Investigation  Addendum — Main  Rudder  PCU  Thermal  Testing  and  Dimensional  Examinations,”  dated 
April  18, 1997. 

As  previously  discussed,  the  hydraulic  fluid  used  in  the  silting  tests  was  collected  from  in-service 
737  aircraft  and  met  the  NAS  1638  hydraulic  fluid  cleanliness  limits  for  Class  10  and  Class  12  fluids. 
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in  this  section  because  the  USAir  flight  427  PCU  exhibited  anomalous  behavior  during 
this  test  condition. 

For  these  three  thermal  test  conditions,  the  exterior  temperature  of  the  PCU  servo 
valve  housing  was  allowed  to  reach  and  stabilize  at  a  temperature  believed,  at  the  time  the 
tests  were  conducted,  to  be  representative  of  the  vertical  stabilizer  cavity  (where  the 
rudder  PCU  is  located)  of  the  accident  airplane  just  before  the  upset  (-27  to  -40° 

These  temperatures  were  achieved  before  each  test  without  hydraulic  fluid  circulating 
through  the  PCU.  Also,  the  PCU  servo  valve  housing  continued  to  be  cooled  by  the  cold 
ambient  air  inside  the  test  chamber  and  was  warmed  to  varying  degrees  and  at  varying 
rates  by  the  introduction  of  hydraulic  fluid  into  the  servo  valve. 

1 .1 6.5.4.7.1  Baseline  Test  Condition 

This  test  condition  approximated  the  system  operating  temperatures  that 
investigators  initially  hypothesized  for  the  USAir  427  accident  airplane  if  both  hydraulic 
systems  A  and  B  were  operating  normally  (PCU  temperatures  of  about  10  to  20°  F  and 
hydraulic  fluid  temperatures  of  about  70°  F  at  the  PCU  inlet).  Test  results  for  this 
condition  indicated  that  the  difference  in  the  servo  valve  exterior  surface  temperature  and 
the  hydraulic  fluid  temperature  at  the  PCU  was  approximately  50  to  60°  F.  Both  the  new- 
production  PCU  and  the  accident  airplane’s  PCU  responded  normally  during  all  tests 
under  this  condition. 

1.16.5.4.7.2  Simulated  Hydraulic  System  Failure  Condition 

In  this  test  condition,  the  temperature  of  the  hydraulic  fluid  entering  the  PCU  was 
raised  to  simulate  a  malfunction  of  one  of  the  EDPs.  Boeing  could  not  provide  flight  test 
data  for  the  temperature  of  the  hydraulic  fluid  at  the  PCU.  Therefore,  at  the  Safety  Board  s 
request,  Boeing  performed  a  thermal  analysis,  which  indicated  that  a  failed  EDP  could 
raise  the  temperature  of  the  hydraulic  system  reservoir  associated  with  the  pump  failure  to 
180  to  207°  F.  (The  737  incorporates  a  hydraulic  fluid  temperature  sensor  near  the  EDPs 
that  provide  a  cockpit  indication  of  an  overheat  condition  when  the  hydraulic  fluid  reaches 
or  exceeds  220°  F.  The  accident  airplane’s  CVR  recorded  no  flight  crew  comment 
regarding  hydraulic  system  overheating.)  Boeing’s  thermal  analysis  also  indicated  that,  if 
the  hydraulic  fluid  were  to  overheat  to  a  point  just  below  the  threshold  of  the  overheat 
detector,  the  hydraulic  fluid  would  cool  to  about  170°  F  as  it  passed  from  the  hydraulic 
pumps  to  the  end  of  the  pressurized  section  of  the  fuselage.  The  fluid  would  then  pass 
through  about  15  feet  of  3/8-inch  diameter  steel  tube  before  it  would  reach  the  hydraulic 
fluid  inlet  point  on  the  main  rudder  PCU. 


The  temperatures  used  during  these  tests  (-27  to  -40°F)  were  based  on  the  results  of  Boeing’s  thermal 
analyses.  In  October  and  December  1996,  Boeing  conducted  flight  tests  to  measure  the  operating 
temperatures  of  the  737  hydraulic  system  and  main  rudder  PCU  in  a  normal  operating  environment.  The 
December  1996  tests  indicated  that  the  PCU  servo  valve  housing  operating  temperature  was  greater  than 
-27®F,  as  discussed  at  the  end  of  this  section. 
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The  tests  for  this  condition  were  conducted  with  the  hydraulic  fluid  temperature 
raised  to  about  170°  F  at  the  point  that  the  fluid  entered  the  thermal  test  chamber.  The  fluid 
was  then  cooled  by  the  ambient  conditions  in  the  chamber  (temperatures  in  the  chamber 
were  between  -27  and  -40°  F)  as  the  fluid  passed  through  the  steel  tubing  into  the  main 
rudder  PCU.  Testing  was  conducted  with  both  hydraulic  systems  A  and  B  overheated  and 
with  only  system  A  overheated  (system  B  was  at  about  60°  F).  Test  results  for  these 
conditions  indicated  that  the  difference  in  the  servo  valve  exterior  surface  temperature  and 
the  hydraulic  fluid  temperature  at  the  PCU  inlet  was  approximately  100°  F.  Both  the  new- 
production  PCU  and  the  accident  airplane’s  PCU  responded  normally  during  all  tests 
under  this  condition. 

1.16.5.4.7.3  Extreme  Temperature  Differential  Test  Condition 

This  test  condition  examined  the  effects  of  subjecting  the  PCU  to  a  relatively 
extreme  differential  between  the  hydraulic  fluid  temperature  at  the  PCU  inlet  and  the 
servo  valve  exterior  surface  temperature.  The  extreme  temperature  differential  produced 
during  this  test  condition  would  not  be  expected  during  normal  flight  operations.  For  this 
test  condition,  the  PCU  was  cooled  to  about  -40°  F  while  both  hydraulic  systems  were 
depressurized  (no  hydraulic  fluid  passing  through  the  PCU).  At  the  beginning  of  these 
tests,  heated  hydraulic  fluid  only  from  system  A  (at  a  temperature  of  170°  F)  was  inserted 
directly  into  the  PCU.  The  maximum  temperature  differential  between  the  inlet  hydraulic 
fluid  and  the  servo  valve  housing  of  180°  F  was  attained  25  seconds  after  insertion  of  the 
heated  hydraulic  fluid. 

The  new-production  PCU  responded  normally  under  the  extreme  temperature 
differential  test  condition.  However,  the  USAir  flight  427  PCU  exhibited  anomalous 
behavior  during  these  tests.  During  the  August  1996  extreme  temperature  differential 
tests,  the  accident  airplane’s  PCU  responded  normally  for  the  initial  three  external  input 
crank  commands,  but  the  external  input  crank  stuck  in  the  full  left  rudder  position  for 
about  5  seconds  at  the  end  of  the  fourth  input  command.  Afterward,  the  movement  of  the 
external  input  crank  was  normal,  except  for  a  hesitation  in  motion  as  the  crank  was  pushed 
and  pulled  on  each  input  command  in  both  the  rudder  left  and  rudder  right  directions. 

The  anomalous  operation  of  the  USAir  flight  427  PCU  was  verified  by  a  repeat 
test.  During  this  repeat  test,  the  PCU  responded  normally  for  one  input  command. 
However,  during  the  next  two  input  command  cycles,  the  external  input  crank  moved 
slower  than  normal  for  the  left  rudder  command.  At  the  end  of  the  fourth  left  rudder 
command  cycle,  the  external  input  crank  stuck  in  the  full  left  rudder  position  for  about 
1  second,  after  which  the  movement  of  the  external  input  crank  returned  to  normal. 

To  further  examine  the  extreme  temperature  differential  test  condition,  the  PCU 
temperature  was  once  again  lowered  to  about  -40°  F  and  stabilized,  and  the  test  was 
repeated  again.  During  this  repeat  test,  the  PCU  responded  normally  for  the  first  three 
input  commands.  During  the  next  3  input  commands,  however,  the  external  input  crank 
moved  slower  than  normal  during  the  left  rudder  command.  At  the  end  of  each  of  these 
left  rudder  command  inputs,  the  force  required  to  return  the  input  crank  to  neutral 
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increased  to  about  124  pounds  for  about  1  second.  Afterward,  the  external  input  crank 
returned  to  its  neutral  position  with  the  application  of  less  than  5  pounds  of  force. 

The  October  1996  tests  under  the  extreme  temperature  differential  test  condition, 
which  utilized  improved  temperature  control  and  data  collection  systems,  yielded  similar 
results  for  the  USAir  flight  427  PCU.  Examination  of  the  hydraulic  fluid  flow  data 
revealed  that  momentary,  anomalous  increases  in  hydraulic  system  fluid  return  flow 
occurred  during  the  jamming/binding.  Further  examination  of  the  data  indicated  that  the 
servo  valve  secondary  slide  momentarily  jammed  to  the  servo  valve  housing  and  that  the 
subsequent  overtravel  of  the  primary  slide  resulted  in  an  increase  in  system  return  flow 
that  could  cause  a  rudder  actuator  reversal  (travel  in  the  direction  opposite  to  that 
commanded).  Although  reversal  of  the  PCU  actuator  was  not  noted  by  any  of  the 
participants  or  observers  during  the  tests,  the  periods  of  anomalous  hydraulic  system  fluid 
flow  observed  in  the  data  were  consistent  with  the  mi  sporting  of  the  hydraulic  fluid  from 
the  effects  of  the  jammed  secondary  slide  and  overtravel  of  the  primary  slide,  resulting  in 
a  momentary  output  command  opposite  to  the  input  command. 

1.16.5.4.7.4  Additional  Testing 

The  USAir  flight  427  PCU  was  disassembled  and  examined  at  Parker  after  both  of 
the  August  and  October  1996  test  series  were  completed.  The  primary  slide,  secondary 
slide,  and  interior  of  the  servo  valve  housing  showed  no  evidence  of  damage  or  physical 
marks  from  jamming  or  binding  during  the  thermal  testing.  The  PCU  also  passed  the 
functional  acceptance  test  procedure  used  by  Parker  for  validating  PCU  performance. 

On  October  4,  1996,  at  the  Safety  Board’s  request,  Boeing  conducted  a  flight  test 
to  measure  the  operating  temperatures  of  the  737  hydraulic  system  and  main  rudder  PCU 
in  a  normal  operating  environment.  A  test  airplane  was  flown  for  about  2  hours  at  an 
altitude  of  up  to  30,000  feet.  Measurements  included  static  air  temperature  outside  the 
airplane  (-40°  F),  temperature  on  PCU  body  (20°  F),  and  temperature  of  the  hydraulic 
fluid  exiting  the  EDP  (100°  F). 

Additional  temperature  data  was  obtained  during  a  flight  test  on  December  6, 
1996,  that  was  conducted  by  Boeing  (at  the  request  of  the  Safety  Board)  with  additional 
instrumentation.  During  this  flight  test,  a  test  airplane  was  flown  for  about  2  hours  at  an 
altitude  of  up  to  35,000  feet,  and  then  the  airplane  descended  to  20,000  feet  for  1  hour. 
Data  from  this  flight  test  indicated  the  following  temperatures  at  35,000  feet:  static  air 
outside  the  airplane,  -58°  F;  hydraulic  system  A  fluid  at  the  outlet  of  the  EDP,  58°  F; 
hydraulic  system  A  fluid  at  the  PCU  inlet,  22°  F;  hydraulic  system  B  fluid  at  the  PCU 
inlet,  34°  F;  PCU  servo  valve  housing,  35°  F;  and  ambient  air  around  the  PCU  (inside  the 
vertical  stabilizer),  -15°  F. 

Data  from  this  flight  test  indicated  the  following  temperatures  at  20,000  feet;  static 
air  outside  the  airplane,  -36°  F;  hydraulic  system  A  fluid  at  the  outlet  of  the  EDP,  65°  F; 
hydraulic  system  A  fluid  at  the  PCU  inlet,  35°  F;  hydraulic  system  B  fluid  at  the  PCU 
inlet,  35°  F;  PCU  servo  valve  housing,  38°  F;  and  ambient  air  around  the  PCU  (inside  the 
vertical  stabilizer),  0°  F. 
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In  February  1997,  Boeing  independently  conducted  a  third  series  of  thermal 
tests. These  tests  were  conducted  on  a  main  rudder  PCU  that  was  specifically  selected 
by  Boeing  because  it  had  the  tightest  diametrical  clearances  (between  the  primary  and 
secondary  slides  and  between  the  secondary  slide  and  servo  valve  housing)  that  would 
pass  the  Parker  functional  acceptance  test  procedure  frictional  requirements.'^* 

Boeing  reported  that  this  minimum  tolerance  PCU  servo  valve  operated  normally 
for  each  test  condition  designed  to  simulate  a  hydraulic  system  overheat,  with  one  or  both 
hydraulic  systems  circulating  fluid  through  the  servo  valve  before  insertion  of  the  heated 
fluid  and  at  Boeing’s  estimated  normal  operating  temperatures  within  the  vertical  fin 
(conditions  similar  to  those  used  in  the  Safety  Board’s  simulated  hydraulic  system  failure 
tests).  Boeing  conducted  additional  tests  in  which  hot  hydraulic  fluid  was  injected  directly 
into  the  minimum  tolerance  servo  valve.  Hydraulic  fluid  was  not  circulated  through  the 
servo  valve  before  insertion  of  the  heated  hydraulic  fluid  (conditions  similar  to  those  used 
in  the  Board’s  extreme  temperature  differential  tests).  In  some  tests  under  these  two 
conditions,  the  minimum  tolerance  servo  valve’s  secondary  slide  jammed  to  the  servo 
valve  housing  (and  remained  jammed  as  long  as  the  force  on  the  input  crank  was 
maintained).  The  smallest  temperature  differential  between  the  inlet  hydraulic  fluid  and 
the  servo  valve  housing  at  which  the  minimum  tolerance  PCU  jammed  was  145°  F. 

1 .16.5.4.8  Rudder  Actuator  Reversals  During  Servo  Valve  Secondary 
Slide  Jams 

After  the  Safety  Board’s  October  1996  thermal  tests,  Boeing  engineers  began  an 
independent  detailed  examination  of  the  test  data.  Their  review  of  the  data  indicated  that 
the  PCU  servo  valve  responded  slowly  and  erratically  to  the  input  commands  when  the 
secondary  slide  was  jammed  to  the  housing  by  the  thermal  shock  and  an  input  was  applied 
to  the  external  input  arm.  Boeing  subsequently  conducted  tests  using  a  new-production 
PCU  that  had  been  modified  to  simulate  a  jam  of  the  secondary  slide  to  the  servo  valve 
housing  at  various  positions  and  then  to  simulate  the  application  of  a  full  rudder  input  to 
the  PCU.  These  tests  revealed  that,  when  the  secondary  slide  was  jammed  to  the  servo 
valve  housing  at  certain  positions,  the  primary  slide  could  travel  beyond  its  intended  stop 
position  because  of  bending  or  twisting  of  the  PCU’s  internal  input  linkages  (compliance). 
This  deflection  allowed  the  primary  slide  to  move  to  a  position  at  which  the  PCU 
commanded  the  rudder  in  the  direction  opposite  of  the  intended  command  (reversal). 
Specifically,  the  tests  revealed  that,  when  the  secondary  slide  was  jammed  at  positions 
greater  than  50  percent  off  neutral  toward  the  extend  or  retract  position  and  a  full-rate 
command  was  applied  to  the  PCU,  the  rudder  would  move  opposite  to  the  commanded 
position.'^® 


See  Boeing’s  Test  and  Analysis  of  737  Rudder  Power  Control  Unit  (PCU)  Valve  Thermal  Jam 
Potential,  Boeing  correspondence  B-B600-16147-ASI,  May  29,  1997. 

As  noted  in  section  1.16.5.4.1,  the  diametrical  clearance  of  the  minimum  tolerance  servo  valve 
(secondary  slide  to  servo  valve  housing)  was  0.000070  inch.  (The  same  clearance  in  the  USAir  flight  427 
main  rudder  PCU  servo  valve  was  0.000130  inch. 
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Figures  14  and  15  show  normal  operation  of  the  servo  valve.  Figure  16  shows  the 
servo  valve  with  a  secondary  slide  jam  (normal  operation).  Figure  17  shows  the  servo 
valve  with  a  secondary  slide  jam  and  primary  slide  in  the  overtravel  condition. 


Primary  and  Secondary  Slides  at  ^^feutral 
Rudder  Rate  =  0 


Neutraf 


R  L«ft  P  Rifiht  R 


Figure  14.  Normal  operation  of  the  737  PCU  servo  valve  with  slides  in  the  neutrai 

position  (no  jam). 


’’’  The  Safety  Board  has  investigated  several  fatal  aviation  accidents  that  have  involved  flight  control 
reversals.  In  some  cases,  improper  maintenance  resulted  in  an  airplane’s  aileron  controls  being  connected 
backward  so  that  a  pilot  control  wheel  input  intended  to  command  a  right  turn  resulted  in  a  left  turn.  See  the 
following  National  Transportation  Safety  Board  accident  reports:  ANC94LA101  (August  3,  1994), 
IT'W92FA218  (August  25,  1992),  ATL88LA149  (June  4,  1990),  ANC88FA062  (May  20.  1988), 
LAX85LA104  (January  10, 1985),  MIA84FA040  (December  4, 1983),  and  MKC83FA090  (April  15,  1983). 
Also,  see  National  Transportation  Safety  Board  Briefs  of  Accident  1469  (August  20,  1982)  and  3-1496 
(June  9, 1976). 
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Nbtmal  Full  Rate  Command- 
Primary  &  Secondary  Slides  FuU  Open 
Rudder  Rate 

Neutral 


R  L«ft  P  Right  R 

Iff  I 


Figure  15.  Normal  operation  of  the  737  PCU  servo  valve  with  slides  in  the  extend 

command  position  (no  jam). 


Intended  Operation: 

Secondary  Slide  J ammed  Full  Open,  Primary  Slide  Opposing 
(Full  Cross  Flow) 

Neutral  Rudder  Rate  =0 


R  Left  P  Right  R 

T  t  I  ^ 


Figure  16.  PCU  servo  valve  intended  operation  with  the  secondary  slide  jammed  to  the 
servo  valve  housing  and  primary  slide  opposing. 
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Newly  Dis  covered  Failure  Effect: 

Secondary  Slide  J  ammed  Full  Open,  Primary  Slide  Over-Stroked 
ki  Opposing  Direction 
Neutral  Rudder  Rate  TEL 


R  L«R  P  RlgM  R 

III  I 


Figure  17.  PCD  servo  valve  with  the  secondary  slide  jammed  to  the  servo  valve  housing 
and  the  primary  slide  in  the  overtravel  condition. 

After  studying  the  thermal  test  conditions  in  which  the  USAir  flight  427  main 
rudder  PCU  jammed,  the  Safety  Board  attempted  to  determine  the  combined  effects  of 
PCU  servo  valve  secondary  slide  jamming  and  input  linkage  deflections  (compliance)  to 
determine  if  the  USAir  flight  427  PCU  was  more  susceptible  to  reversal  than  other  servo 
valves.  These  tests  were  conducted  in  November  1996  on  three  PCUs:  a  new-production 
PCU,  the  USAir  flight  427  PCU,  and  the  Eastwind  flight  517  PCU.  For  this  series  of  tests, 
a  tool  was  used  to  mechanically  jam  the  secondary  slides  of  all  three  PCUs  to  their 
respective  servo  valve  housings.  Manual  inputs  were  then  applied  to  the  PCUs  with  the 
yaw  damper  energized  and  deenergized  (np  yaw  damper  command  was  applied  in  both 
cases).  When  inputs  at  a  less-than-maximum  rate  were  made  to  the  PCU,  all  three  PCUs 
operated  normally.  However,  if  the  external  input  crank  rate  exceeded  the  capability  of  the 
PCU  to  respond  at  its  maximum  rate,  the  input  caused  deflection  of  the  internal  linkages 
(that  is,  caused  them  to  bend  or  twist),  resulting  in  overtravel  of  the  primary  slide  and  a 
reverse  rudder  response  (that  is,  a  response  opposite  to  that  commanded). 

To  identify  the  threshold  for  reversal,  the  Safety  Board  conducted  tests  on  the  three 
PCUs  to  determine  the  distance  that  the  secondary  slides  had  to  be  placed  away  from  the 
neutral  (“no  rudder  command”)  position  to  result  in  rudder  actuator  reversal  when  an  input 
force  was  applied  to  the  PCU.  The  tests  indicated  that  each  of  the  three  PCUs  would  stall 
(stop  movement)  or  reverse  when  the  secondary  slide  was  jammed  at  or  beyond  the 
following  positions  (expressed  as  a  percentage  of  full  secondary  slide  travel  from  the 
neutral  position): 
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•  New-production  PCU:  38  percent  in  the  extend  direction,  54  percent  in  the 
retract  direction. 

•  US  Air  flight  427  PCU:  12  percent  in  the  extend  direction,  41  percent  in  the 
retract  direction. 

•  Eastwind  flight  517  PCU:  17  percent  in  the  extend  direction,  30  percent  in  the 
retract  direction. 

On  August  20,  1997,  the  Safety  Board  conducted  additional  tests  on  the  US  Air 
flight  427  and  Eastwind  flight  517  PCUs  to  determine  the  effects  of  a  jammed  secondary 
slide  on  the  force  and  rate  of  rudder  movement.  For  these  tests,  each  PCU  was  installed  in 
a  test  fixture  at  Parker  that  simulated  the  airplane  installation,  and  the  servo  valve 
secondary  slide  was  jammed  with  the  jamming  tool.  Table  6  shows  the  test  results,  which 
indicated  that  the  position  of  the  secondary  slide  jam  affected  the  rudder’s  output  (force 
and  rate). 


Table  6.  Test  results  on  the  effects  of  a  jammed  secondary  slide  on  the  force  and  rate  of 
rudder  movement. 


PCU 

Position 

(percent  off  neutrai) 

Force 

(percent  of  full  PCU 
output  capability)^ 

Rate 

(degrees  per  second) 

USAir  427 

0 

100 

31.7 

USAir  427 

12 

50 

3.9'> 

USAir  427 

22 

76 

g-s** 

USAir  427 

50 

88 

17.8'> 

USAir  427 

71 

93 

26.6“ 

USAir  427 

100' 

~  100 

-33 

Eastwind  517 

0 

100 

31.7 

Eastwind  517 

22 

34 

4.8“ 

Eastwind  517 

50 

79 

14.3“ 

Eastwind  517 

71 

89 

25.4“ 

Eastwind  517 

100' 

-  100 

-33 

®  Full  PCU  output  capability  is  5,800  pounds. 

^  Rudder  motion  was  in  the  opposite  direction  from  that  commanded. 

°  The  100-percent  secondary  slide  jam  position  was  not  tested  for  either  PCU  because  of  test  equipment 
limitations.  Force  and  rate  values  for  both  100-percent  positions  are  estimated  by  Boeing. 


1.16.5.4.9  Ground  Demonstration  of  Rudder  PCU  Servo  Valve  Jam 

In  June  1997,  the  Safety  Board  participated  in  a  ground  demonstration  conducted 
by  Boeing  at  its  facility  in  Seattle,  Washington.*®”  The  demonstration  was  intended  to 
identify  and  document  the  cockpit  characteristics  of  a  rudder  PCU  servo  valve  secondary 
slide  jam.  The  demonstration  was  accomplished  in  a  newly  manufactured  737-300 
airplane  that  was  fitted  with  a  special  tool  to  simulate  a  rudder  PCU  servo  valve  secondary 
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slide  jam  at  three  different  positions  (about  0  percent,  about  25  percent,  and  about 
50  percent  of  travel  from  the  neutral  position).  The  demonstration  was  conducted  while 
the  airplane  was  parked  on  the  ground  with  both  engines  off  and  with  hydraulic  systems 
powered  by  an  external  source  of  power. 

Before  the  demonstration  began,  the  participants  sat  in  the  pilot  seats  of  another 
newly  manufactured  737-300  and  manipulated  the  rudder  pedals  to  become  familiar  with 
the  feel  of  a  normally  functioning  737  rudder  system  on  the  ground.  The  participants  then 
moved  to  the  airplane  that  was  fitted  with  the  special  jamming  tool,  and  each  participant 
manipulated  the  rudder  pedals  under  the  three  simulated  rudder  jam  conditions.  As 
recorded  in  the  Human  Performance  Group  Chairman’s  addendum  report,  one  Safety 
Board  participant  described  the  demonstration  as  follows: 

All  demonstrations  were  conducted  in  the  cockpit,  with  Boeing  test 
pilot. .  .sitting  in  one  of  the  pilot  seats  to  coordinate  the  procedure. . . .  When 
I  was  the  active  participant,  I  sat  in  the  right  seat  wearing  the  seat  belt. 

The  first  demonstration  in  the  test  airplane  represented  a  jam  of  the 
secondary  slide  about  25  percent  off  [its]  neutral  position.  I  pushed  the 
respective  rudder  pedals  slowly  to  their  full  down  positions  as  though 
I  were  performing  a  slow  rudder  system  check.  The  right  rudder  pedal 
seemed  easier  to  push  down  than  the  left  pedal,  although  the  difference 
seemed  subtle.  I  then  performed  about  7  tests  in  which  I  [applied]  hard  left 
rudder.  With  one  or  two  exceptions,  this  input  triggered  a  rudder  reversal 
on  the  pedals.  Immediately  after  my  input,  the  left  rudder  pedal  began 
moving  outwards  until  it  reached  the  upper  stop.  The  motion  was  slightly 
slower  than  an  input  I  would  expect  from  a  human.  The  motion  was  steady 
and  continued  without  pause  no  matter  how  hard  I  pushed  to  counter  it 
(“unrelenting”  was  a  description  that,  at  the  time,  seemed  to  capture  my 

impression) _  [When]  I... “stopped  fighting”  the  motion,  [the]  action  of 

the  rudder  system  ended  almost  immediately  and  the  rudder  pedals 
returned  to  the  neutral  position.  On  subsequent  trials,  I  “stopped  fighting” 
the  rudder  motion  earlier,  before  the  left  j^dal  had  reached  the  upper  stop. 

Again,  the  rudder  motion  stopped  almost  immediately  as  soon  as  I  stopped 
applying  pressure,  no  matter  where  the  pedal  was  located,  and  the  pedals 
returned  to  neutral. 

The  second  demonstration  represented  a  jam  of  the  secondary  slide  about 
0  percent  off  [its]  neutral  position.  I  pushed  each  respective  rudder  pedal 
slowly  to  the  lower  stop  as  though  performing  a  rudder  system  check.  The 
right  pedal  again  seemed  easier  to  push  than  the  left  pedal,  although  the 
difference  was  small.  I  also  pushed  the  rudder  pedals  aggressively  and 
abruptly,  but  this  did  not  produce  a  rudder  reversal  situation. 

The  third  demonstration  represented  a  jam  of  the  secondary  slide  about 
50  percent  off  [its]  neutral  position.  I  performed  about  9  trials.  When 


Representatives  of  the  interested  parties  who  were  members  of  the  Human  Performance  Group  were 
notified  of  the  demonstration  but  declined  to  participate.  However,  party  members  of  the  Systems  Group  and 
a  representative  from  the  expert  technical  panel  were  present  during  the  testing  and  participated  informally 
in  the  tests. 
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I  moved  the  pedals  slowly  and  steadily  [as  though  performing  a  rudder 
system  check],  I  was  generally  able  to  move  the  pedals  to  their  stops 
without  starting  a  reversal.  Sometimes,  however,  even  a  slow  input 
initiated  a  rudder  reversal  situation  (this  time  with  the  right  pedal  moving 
to  the  upper  stop).  Any  abrupt  motion  on  the  pedals  initiated  an  immediate 
rudder  reversal  situation.  The  rudder  reversal  motion  was  faster  than  was 
the  case  with  a  jam  in  [the]  25  percent  position,  perhaps  similar  to  a  relaxed 
or  slow  input  speed  by  a  human  operator.  Again,  it  was  impossible  to  stop 
the  motion  by  physically  pushing  against  the  rudder  pedal.  On  several 
trials,  I  tried  relaxing  my  input  momentarily  before  the  rudder  pedal 
reached  the  upper  stop.  I  found  that  the  rudder  reversal  motion  continued. 

This  [was  not  true  in  the  jam  at  the  approximate  25  percent  position],  when 
the  relaxation  of  pressure  seemed  to  automatically  stop  the  reversal  motion. 

This  motion  was  faster,  easier  to  initiate,  and  more  difficult  to  stop. 

Other  participants  reported  similar  experiences  during  the  demonstrations  They 
described  the  rudder  back  pressure  during  the  reversal  as  “machine-like,”  “startling,”  and 
“relentless.” 

Another  Safety  Board  employee  who  participated  in  the  demonstrations  stated  that 
he  switched  the  hydraulic  system  B  flight  control  switch  to  “standby  rudder”  during  the 
simulation  of  a  secondary  slide  jam  near  the  50-percent  position,  which  eliminated  the 
rudder  reversal  and  allowed  the  rudder  to  be  centered  by  rudder  pedal  inputs  in  the  normal 
direction.  He  reported  that  the  centering  was  slow  and  required  more  rudder  pedal 
pressure  than  in  the  absence  of  a  jam  but  that  there  was  no  need  to  release  the  rudder  pedal 
pressure  and  reapply  it  to  eliminate  the  reversal.  During  subsequent  rudder  sweeps  with 
the  standby  rudder  system  engaged,  the  rudder  did  not  reverse.  This  Safety  Board 
employee  (who  is  5  feet  8  inches  tall)  further  stated  that  he  was  able  to  reach  the  hydraulic 
system  A  and  B  flight  control  switches  in  the  overhead  panel  without  difficulty  from  either 
the  left  or  right  pilot  seats. 

1.16.6  Flight  Performance  Simulation  Studies 

During  the  investigation  of  the  USAir  flight  427  accident,  Boeing  applied  a 
“kinematics  analysis,”  that  is,  a  technique  developed  from  prior  flight  test  activities  to 
derive  from  available  FDR  data  the  position  of  the  flight  control  surfaces  that  were  not 
among  the  parameters  recorded  by  the  FDR.'^'  The  Safety  Board  reviewed  Boeing’s 
kinematics  process  early  in  the  investigation  and  then  developed  its  own  kinematics 
programs  that  ran  on  the  Board’s  computer  workstation.  The  Safety  Board  developed  the 
programs  to  validate  the  kinematics  solutions  being  developed  by  Boeing  for  the  USAir 
flight  427  investigation  and  now  has  the  technique  available  for  use  in  future  aviation 
investigations. 


Boeing’s  kinematics  process  involves  fitting  curves  through  available  FDR  data  (such  as  heading, 
pitch,  and  roll),  obtaining  time  histories  of  rates  from  these  curves,  and  obtaining  accelerations  from  these 
rates.  Forces,  moments,  and  aerodynamic  coefficients  are  then  obtained  from  these  accelerations  using 
Newton’s  laws  of  physics.  Boeing  uses  its  aerodynamic  models  to  derive  flight  control  time  histories  from 
the  aerodynamic  coefficients. 
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The  Safety  Board’s  kinematic  results  were  compared  with  Boeing’s  kinematic 
results  for  the  same  inputs.  Because  the  review  of  the  kinematic  results  indicated  that  more 
frequent  heading  samples  were  needed  to  effectively  perform  the  kinematic  calculations, 
the  Safety  Board  and  Boeing  used  interpolation  techniques  to  curve  fit  the  FDR’s 
magnetic  heading  data  and  thereby  provide  data  between  the  FDR  data  points.  (As 
indicated  in  section  1.11.2,  the  accident  airplane’s  FDR  recorded  magnetic  heading  data  at 
a  once-per-second  rate.)  The  FDR’s  once-per-second  magnetic  heading  data  could  be 
matched  by  different  interpolation  techniques,  each  resulting  in  different  rudder  surface 
time  histories.  Further,  kinematics  techniques  magnified  the  noise'^^  that  was  inherent  in 
the  accident  airplane’s  FDR  data,  so  smoothing  techniques  were  needed  to  reduce  this 
noise  and  minimize  the  potential  for  erratic  signatures  in  the  extracted  control  surface  time 
histories. 

Safety  Board  investigators  used  the  Safety  Board’s  workstation-based  flight 
simulation  computer  program'^^  for  the  737-200  and  -300  to  perform  simulations  of  the 
flights  of  USAir  flight  427,  United  flight  585,  and  Eastwind  flight  517.'^  The  flight 
simulation  process  was  used  by  the  Safety  Board,  rather  than  the  kinematics  process, 
because  it  eliminated  the  uncertainties  introduced  into  the  kinematics  process  through  the 
data  interpolation  and  smoothing  techniques  (required  because  of  the  limited  number  of 
FDR  parameters  recorded  and  the  limited  sampling  of  the  data).  The  Safety  Board  initially 
used  assumed  flight  control  (control  wheel  [aileron  and  spoilers],  rudder,  and  control 
column  [elevator])  positions  (based  on  earlier  Boeing  and  Safety  Board  kinematic 
solutions  and  FDR-recorded  column  position  when  available)  as  inputs  into  its  computer 
simulations  and  then  compared  the  output  of  the  simulations — such  as  altitude,  airspeed, 
and  heading — with  the  available  FDR  data.  Safety  Board  investigators  then  modified  the 
control  input,  reran  the  simulations,  and  continued  this  process  (known  as  iteration)  until  a 
good  match  with  the  FDR  data  was  obtained.'^^ 

Various  factors  affect  the  extent  to  which  the  derived  control  surface  positions 
reflect  the  actual  control  surface  positions.  For  example,  the  accuracy  of  the  USAir  flight 
427  simulations  is  affected  by  the  fidelity  of  the  aerodynamic  modeling  of  the  airplane  in 
the  flight  conditions  at  the  time  of  the  upsets.  The  aerodynamic  models  used  in  the 
simulations  are  validated  by  flight  tests,  but  this  validation  process  is  limited  by  safety 


According  to  page  60  of  Boeing’s  “Submission  to  the  National  Transportation  Safety  Board  for  the 
USAir  427  Investigation,”  dated  September  30, 1997,  “when  the  heading  data  is  sampled  at  less  than  twice  a 
second,  the  rudder  position  derived  using  kinematics  becomes  contaminated  with  an  overlying  ‘noise’  signal 
that  shows  up  as  an  oscillation  in  derived  rudder....  Proper  interpolation  can  reduce  the  noise  providing 
more  reliable  information  on  rudder  movement.” 

The  Safety  Board’s  flight  simulation  computer  program  is  a  Windows™-based  executive  program 
that  uses  Boeing-developed  flight  control,  aerodynamics,  and  engine  models  to  derive  force  and  moment 
time  histories  of  the  airplane.  Safety  Board-developed  equations  of  motion  convert  these  forces  and 
moments  into  airplane  motion. 

The  Safety  Board’s  workstation-based  flight  simulations  used  computer  software  that  describes  the 
physics  of  the  motion  of  an  airplane  in  flight  and  various  computer  subroutines,  including  those  that  use  data 
and  equations  from  Boeing,  to  describe  the  737’s  aerodynamic  characteristics  and  engine  thrust. 

Boeing  also  performed  similar  flight  simulations  on  its  own  computer  workstations. 
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factors,  such  as  the  structural  load  limits  for  which  flight  tests  can  be  safely  conducted, 
and  the  number  of  flight  tests  to  be  conducted. 

In  addition,  the  computer  simulations  generally  assumed  calm  air  conditions. 
Although  most  of  the  flight  from  ORD  to  PIT  occurred  in  smooth  air,  studies  of  FDR, 
CVR,  and  radar  data  indicate  that,  during  the  initial  upset,  USAir  flight  427  encountered 
wake  vortices  from  the  727  that  preceded  it  on  the  approach  to  PIT  (Delta  flight  1083). 
Therefore,  the  effect  of  the  wake  was  taken  into  account  at  the  times  when  the  FDR  and 
CVR  data  indicated  that  the  accident  airplane  was  being  affected  by  the  wake  vortices. 
The  effects  of  the  wake  vortices  on  the  airplane’s  motion  were  based  on  a  theoretical 
model  that  was  modified  to  account  for  the  effects  on  the  yawing  moment  that  were 
developed  from  the  wake  vortex  flight  tests  and  improve  the  match  with  vertical 
acceleration  and  pitch  angle  FDR  data.'^^ 

Further,  the  United  flight  585  airplane  most  likely  encountered  significant  winds 
and  turbulence;  thus,  the  computer  simulations  were  adjusted  to  account  for  such  winds. 
However,  because  the  actual  wake  vortex  and  turbulence  conditions  were  not  known,  the 
respective  contributions  of  the  flight  control  surfaces  and  wake  turbulence/winds  to  the 
motion  of  the  airplane  are  uncertain.  For  example,  if  a  large  rolling  moment  resulting  from 
a  wind  gust  was  quickly  countered  by  the  flight  crew  through  a  large  control  wheel 
movement,  the  resulting  roll  recorded  by  the  FDR  would  be  relatively  small.  If  the  wake 
turbulence/wind  gust  effect  introduced  into  the  simulation  was  less  than  the  actual  wake 
turbulence/wind  gust  experienced  by  the  flight  crew,  the  control  wheel  movements 
derived  through  the  simulations  would  be  less  than  the  movements  that  actually  occurred. 

Other  factors  affecting  the  accuracy  of  the  simulation  studies  include 
instrumentation  calibration  errors  and  time  lags  in  data  recording.  In  addition,  the 
directional  gyroscopes  that  provided  heading  information  to  the  FDRs  in  the  Eastwind 
flight  517  and  United  flight  585  airplanes  could  have  introduced  errors  in  the  recording  of 
the  heading  data  when  the  airplanes  were  operating  in  certain  flight  attitudes.  The  Safety 
Board  accounted  for  part  of  the  potential  heading  gyro  gimbal  errors  by  using  a  computer 
program  especially  developed  for  that  purpose. 


The  effects  of  the  wake  vortices  were  introduced  into  the  simulations  by  slight  modifications  to  the 
coefficients  from  the  737  aerodynamic  model.  Initially,  the  wake  was  modeled  at  Boeing  using  a  Rankine 
vortex  model  and  aerodynamic  strip  theory  for  all  aerodynamic  coefficient  wake  deltas  except  yaw.  The 
Rankine  wake  vortex  model  assumes  that  the  rotational  velocity  increases  linearly  with  distance  from  the 
center  of  the  vortex  to  the  core  radius.  The  velocity  then  decreases  as  the  square  of  the  distance  beyond  the 
core  radius.  The  effect  of  the  wake  on  the  yawing  moment  coefficient  was  obtained  using  empirical  data 
from  the  wake  vortex  flight  tests.  The  wake  was  positioned  relative  to  the  airplane  by  Boeing  to  match  the 
peaks  and  valleys  in  the  FDR-recorded  vertical  acceleration  data.  The  Safety  Board  modified  Boeing’s  lift 
and  pitching  moment  coefficient  wake  deltas  (preserving  the  locations  of  the  peaks  and  valleys)  to  better 
match  FDR  vertical  acceleration  and  pitch  angle  data.  The  original  wake  resulted  in  a  full  control  wheel 
input  at  1902:58.5,  when  the  bank  angle  was  about  15°.  This  result  was  judged  to  be  an  excessive  response 
from  a  human  performance  standpoint.  A  wheel  response  range  of  40  to  60°  at  that  time  was  considered 
more  realistic,  so  the  wake  rolling  moment  was  modified  to  match  a  60°  wheel  input.  The  yawing  moment 
from  the  wake  resulted  from  the  encounters  of  the  vertical  stabilizer  with  the  wake.  The  vertical  stabilizer 
wake  encounter  at  1902:58.5  was  extended  by  0.10  second  to  facilitate  a  match  with  the  FDR  heading  data. 
Similarly,  the  vertical  stabilizer  wake  encounter  at  1903:01.5  was  extended  by  about  0.35  second. 
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Because  a  pilot  exerting  considerable  force  on  the  rudder  pedals  could  alter  the 
rudder  blowdown  limit  that  would  result  from  the  hydraulic  actuator  alone,'^*  the 
simulations  also  had  to  account  for  the  estimated  pilot  rudder  pedal  force  time  history. 
This  estimation  was  accomplished  for  the  USAir  flight  427  and  United  flight  585 
accidents  and  the  Eastwind  flight  517  incident  based  on  the  physical  characteristics  of  the 
flying  pilot,  available  human  performance  research  data,  and  CVR  information.  (See 
section  1.18.8  for  further  information.) 

The  Safety  Board  used  its  computer  simulation  studies  to  evaluate  a  significant 
number  of  potential  scenarios  for  the  USAir  flight  427  and  United  flight  585  accidents  and 
the  Eastwind  flight  517  incident.  The  Safety  Board  also  used  Boeing’s  kinematic  results 
(flight  control  surface  time  histories)  for  USAir  flight  427  in  performing  computer 
simulations  to  assess  how  well  the  Boeing  heading  (and  pitch  and  roll)  results  matched  the 
FDR  data.*^’  Boeing  used  its  kinematic  results  in  performing  its  own  computer 
simulations  for  Eastwind  flight  517  and  comparing  the  heading  results  with  FDR  data. 

All  parties  to  the  investigation  had  the  opportunity  to  submit  proposed  accident 
scenarios.  However,  only  Boeing  submitted  detailed  simulations  or  studies.  The  Safety 
Board  notes  that  Boeing  may  be  one  of  the  few  entities  in  the  world  with  the  technological 
ability  and  knowledge  of  the  737  airplane  to  conduct  the  complex  and  sophisticated 
simulations  that  were  used  during  this  investigation  to  evaluate  potential  accident 
scenarios.  Accordingly,  the  Safety  Board  assumed  that  the  alternative  scenarios  provided 
by  Boeing  were  the  best  alternatives  that  could  be  developed.  The  Safety  Board  therefore 
gave  serious  consideration  to  the  scenarios  submitted  by  Boeing  for  the  USAir  flight  427, 
United  flight  585,  and  Eastwind  flight  517  upset  events.  The  results  of  the  Safety  Board’s 
best-match  solutions'^*'  from  simulation  studies  and  Boeing’s  kinematic  solutions  are 
discussed  in  sections  1.16.6.1,  1.16.6.2,  and  1.16.6.3  for  the  USAir  flight  427  and  the 
United  flight  585  accidents  and  the  Eastwind  flight  517  incident,  respectively. 

1.16.6.1  USAir  Flight  427  Simulation  Studies 

USAir  flight  427  was  flying  in  calm  air  while  making  a  left  turn  to  a  heading  of 
100°.  About  1902:57,  as  the  airplane  was  rolling  toward  wings  level,  it  was  experiencing 


A  heading  gyro  consists  of  a  rotating  gyro  mounted  inside  two  gimbals,  and  heading  data  is  subject 
to  gyro  gimbal  error.  Heading  is  determined  by  the  angle  of  the  outer  gimbal  to  the  airplane  body. 
Combinations  of  pitch,  roll,  and  gyro  rotor  alignment  introduce  angle  errors  into  the  outer  gimbal  and 
produce  predictable  heading  errors  that  can  quantified  and  corrected.  For  a  further  description  of  gimbal 
error,  refer  to  the  Safety  Board’s  “Addendum  to  Eastwind  Rudder  Jam  Study,”  November  11, 1998. 

During  normal  rudder  operation,  a  considerable  pilot  force  on  the  rudder  pedals  can  result  in  the 
rudder  moving  beyond  its  blowdown  limit  based  on  hydraulic  actuator  force  alone.  However,  in  a  rudder 
reversal  situation,  a  considerable  pilot  force  on  the  rudder  pedals  can  reduce  the  blowdown  limit. 

The  USAir  flight  427  FDR  recorded  roll  attitude  twice  per  second  and  pitch  attitude  four  times  per 

second. 

The  Safety  Board’s  best-match  solutions  are  the  derived  flight  control  surface  position  time  histories 
that  best  match  the  recorded  FDR  data,  radar  data,  and  human  performance  information. 

For  additional  information  regarding  the  Safety  Board’s  simulation  studies,  see  the  Board  s  Rudder 
Jam  Simulation  Study,”  dated  January  27, 1998. 
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airspeed  deviations  and  accelerations  consistent  with  wake  turbulence  produced  by  the 
wake  vortex  of  a  Boeing  727.'’^  Within  the  next  few  seconds,  US  Air  flight  427  rolled  to 
about  20°  of  left  bank,  back  to  15°  left  bank,  and  then  farther  to  the  left.  The  airplane 
entered  an  aerodynamic  stall  about  1903:08  and  rolled  more  rapidly  to  the  left.  The  Safety 
Board’s  workstation-based  flight  simulator  computer  program  for  a  737-300  airplane  was 
used  to  simulate  the  event.  Input  to  the  simulation  for  engine  thrust  was  based  on  N1  (fan 
speed)  data  recorded  on  the  FDR. 

As  previously  mentioned,  the  flight  control  surface  position  time  histories  needed 
for  the  computer  simulations  were  not  available  from  the  FDR  and  had  to  be  estimated  or 
derived.  The  Board  derived  the  elevator  position  time  history  from  the  control  column 
position  recorded  by  the  FDR.  The  initial  control  wheel  (aileron  and  spoilers)  position 
inputs  were  based  on  kinematic  solutions  and  were  then  derived  by  iteration.  The  Safety 
Board’s  best-match  simulation  showed  that,  just  after  1902:58,  the  wake  vortex  produced 
a  nose  left  heading  change.  This  simulation  assumed  that  the  flight  crew  responded  to  the 
nose  left  yawing  motion  with  a  right  rudder  pedal  input  about  1903:00.  This  scenario 
further  assumed  that  the  secondary  slide  was  jammed  to  the  servo  valve  housing  and  that 
the  flight  crew’s  rudder  pedal  input  resulted  in  a  rudder  motion  reversal,  with  the  rudder 
reaching  its  blowdown  limit  (about  12.5°)  about  1903:00.  Thus,  the  best-match  simulation 
indicates  that  the  initial  wake  vortex-related  left  yaw  (and  left  heading  change)  was 
followed  about  1  second  later  by  movement  of  the  rudder  to  its  left  blowdown  limit,  which 
resulted  in  a  continuing  left  yaw/heading  change. 

On  the  basis  of  these  assumptions,  rudder  position  time  histories  were  developed 
for  jams  of  the  secondary  slide  to  the  servo  valve  housing  at  100,  71,  50,  and  22  percent 
from  the  neutral  position.’’^  The  rudder  position,  once  reversed,'^'*  was  assumed  to  remain 
at  the  blowdown  limit'^^  corresponding  to  a  main  rudder  PCU  servo  valve  jam  at  the 
100-percent  position  (blowdown  limit  is  partly  dependent  on  jam  position,  airspeed,  and 


Evidence  of  the  turbulence  is  reflected  in  the  vertical  acceleration  and  airspeed  data  recorded  on  the 

FDR. 

For  more  information  on  the  Safety  Board’s  USAir  flight  427  rudder  jam  studies,  see  “Rudder  Jam 
Simulation  Study,”  dated  January  27,  1998,  and  “Addendum  to  Rudder  Jam  Simulation  Study,”  dated 
February  26,  1999.  In  addition,  the  “Kinematics  Validation  Study,”  dated  August  4,  1997,  contains 
information  regarding  basic  kinematics  validation,  curve  fits,  and  simulation  closure. 

In  a  reversal  scenario,  the  primary  and  secondary  slides  are  misaligned  to  produce  reverse  flow  and 
internal  leakage,  which  creates  a  restricted  flow  and  loss  of  pressure.  Because  of  the  reduced  hydraulic 
pressure  ported  to  (moving)  the  actuator  in  the  overtravel  situation,  the  100-percent  jam  resulted  in  the 
rudder  moving  at  a  reduced  rate  of  about  32°  per  second. 

Rudder  blowdown  is  the  maximum  rudder  angle  resulting  from  a  pilot-commanded  full  rudder  input 
under  the  existing  flight  conditions.  It  represents  a  balance  between  the  aerodynamic  forces  acting  on  the 
rudder  and  the  mechanical  forces  produced  by  the  PCU.  The  maximum  rudder  angle  can  be  increased  (or 
decreased  if  the  rudder  reverses)  beyond  that  produced  by  the  hydraulic  force  if  the  pilot  exerts  sufficient 
force  on  the  rudder  pedals.  Rudder  blowdown  was  modeled  in  the  simulation  using  Boeing  data  and 
equations  that  rigorously  model  the  PCU  from  the  valve  input  to  rudder  deflection.  For  the  blowdown 
simulation,  the  valve  input  was  set  to  full  open  (full  commanded  rudder),  and  provisions  for  pilot  rudder 
pedal  forces  were  added,  which  lower  the  blowdown  angle  in  a  reversal.  The  blowdown  simulation  was 
verified  by  comparing  its  output  with  Boeing’s  blowdown  rudder  plots  for  several  conditions  based  on  a 
normally  operating  actuator  and  available  flight  test  data. 
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sideslip  angle)  until  1903:08,  about  the  time  the  airplane  stalled.  The  timing  of  the  rudder 
inputs  was  modified  by  iteration  until  the  simulation  produced  heading  time  histories 
consistent  with  the  FDR  data. 

The  heading  data  that  resulted  from  the  simulation  with  the  secondary  slide 
jammed  to  the  servo  valve  housing  at  the  100-percent  position  matched  the  FDR  heading 
data  better  than  simulations  with  the  secondary  slide  jammed  at  the  other  three  positions. 
Control  surface  position  data  are  presented  for  the  100-percent  jam.  The  pilot  rudder  pedal 
force  time  history  is  shown  in  figure  18a.*^^  The  rudder  surface  and  control  wheel 
positions  are  shown  in  figures  18b  and  18c,  and  the  resultant  heading,  bank  angle,  pitch 
angle,  and  vertical  acceleration  data,  compared  with  the  FDR  data,  are  shown  in  figures 
18d  through  18g,  respectively. 


USAir427 
Simulator  Input 
100%  Jam  Solution 


Figure  18a.  Pilot  rudder  pedal  force  for  USAir  flight  427. 


The  Safety  Board’s  best-match  simulation  used  400  pounds  of  rudder  pedal  force  reducing  to  200 
pounds,  based  on  ergonomic  and  other  research  data  (see  section  1.18.8).  However,  the  Safety  Board  was 
also  able  to  match  the  USAir  flight  427  FDR  data  using  only  the  minimum  pedal  force  necessary  to  sustain 
full  rudder  authority  (about  70  pounds). 
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USAir  427 

Simulator  Response  to  100%  jam 


Time  (hr:min:sec) 

Figure  18d.  Heading  data  for  USAir  flight  427. 
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Figure  18e.  Bank  angle  data  for  USAir  flight  427. 
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USAir  427 
Simulator  Response 
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Figure  18f.  Pitch  angle  data  for  USAir  flight  427. 
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Figure  18g.  Vertical  acceleration  data  for  USAir  flight  427. 
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According  to  Boeing’s  September  30,  1997,  submission  to  the  Safety  Board,''^’ 
Boeing  first  improved  its  wake  vortex  model  using  the  results  of  the  wake  vortex  flight 
tests.  Boeing  then  used  its  kinematics  process  to  determine  the  flight  control  position  time 
histories  during  the  upset  sequence  of  US  Air  flight  427.  Boeing’s  kinematic  analysis 
required  that  the  FDR  heading  data  be  curve  fit  using  interpolation  techniques'^*  and  then 
run  through  data  smoothing  techniques.  These  various  techniques  resulted  in  numerous 
curves  that  could  fit  the  US  Air  flight  427  FDR  heading  data.”^ 

Boeing’s  scenario  assumed  that,  about  1902:58,  the  first  officer  input  right  control 
wheel  (overriding  the  autopilot,  which  had  been  commanding  some  right  control  wheel) 
because  of  the  continuing  left  acceleration  that  the  wake  vortex  encounter  produced.  The 
first  officer  applied  considerable  right  control  wheel,  which  arrested  the  left  roll  and 
increased  the  right  roll  acceleration.  Boeing’s  scenario  then  assumed  that  a  left  rudder 
input  occurred  just  after  1902:59,  resulting  in  a  left  rudder  movement  of  about  12°  just 
before  1903:00.  About  1903:00,  the  full  right  control  wheel  and  the  left  rudder  inputs  were 
being  returned  to  neutral  (the  left  rudder  deflection  was  reduced  to  about  3  ),  but  the 
airplane  was  still  in  the  effect  of  the  wake,  which  was  rolling  the  airplane  to  the  left.  To 
counter  the  left  roll,  the  first  officer  again  applied  considerable  right  control  wheel; 
however,  the  airplane  continued  to  accelerate  in  a  left  roll.  Boeing  s  scenario  also  assumed 
that,  between  1903:00  and  1903:01,  the  first  officer  again  applied  left  rudder  pedal 
pressure,  driving  the  rudder  hard  to  the  left,  and  maintained  the  left  rudder  pedal  input 
until  ground  contact.'**' 

The  rudder  surface  and  control  wheel  position  time  histories  resulting  from 
Boeing’s  kinematic  analysis  for  this  scenario  are  presented  in  figures  19  and  20, 
respectively.  Further,  the  Safety  Board  used  Boeing’s  kinematically  derived  flight  control 
position  time  histories  as  inputs  in  the  Board’s  computer  simulation  to  derive  heading, 
bank  angle,  pitch  angle,  and  vertical  acceleration  data  and  compared  these  results  with  the 
FDR  data.  These  results  are  presented  in  figures  21a  through  2 Id,  respectively. 


Boeing  first  presented  its  kinematic  analysis  of  the  USAir  flight  427  upset  event  in  its  Submission 
to  the  National  Transportation  Safety  Board  for  the  USAir  427  Investigation,”  dated  September,  30,  1997. 
On  October  31,  1997,  Boeing  presented  the  Safety  Board  with  a  refined  version  of  its  USAir  flight  427 
kinematic  analysis.  The  Board  used  Boeing’s  data  from  its  later  presentation  for  this  report. 

A  variety  of  methods  exist  for  curve-fitting  data,  including  mathematical  models  such  as  the  cubic 
spline,  least  squared  polynomial,  and  fast  Fourier  transform  techniques.  Boeing  used  a  technique  that 
involved  fitting  the  data  manually.  (This  manual  technique  involved  reviewing  the  data  and  providing  a 
nonlinear  fit  between  the  FDR  data  points.) 

See  page  17  of  Boeing’s  “Submission  Supplement  USAir  737-300  accident  near  Pittsburgh,  dated 
September  30,  1997. 

Page  49  of  Boeing’s  September  30,  1997,  submission  states  that  “from  [just  after  stickshaker 
activation]  until  ground  impact,  the  controls  remained  at  full  right  wheel,  full  left  rudder,  and  full  aft 
column.” 
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ure  19.  USAir  flight  427  rudder  surface  positions  resulting  from 


Boeing’s  kinematic  analysis. 
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Figure  20.  USAir  flight  427  control  wheel  positions  resulting  from 
Boeing’s  kinematic  analysis. 
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Figure  21a.  Derived  heading  data  for  USAir  flight  427  using 
Boeing’s  kinematic  analysis. 
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Figure  21b.  Derived  bank  angle  for  USAir  flight  427  using 
Boeing’s  kinematic  analysis. 
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USAir  427 
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Figure  21c.  Derived  pitch  angle  for  USAir  flight  427  using 
Boeing’s  kinematic  analysis. 
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Figure  21d.  Derived  vertical  acceleration  data  for  USAir  flight  427  using 
Boeing’s  kinematic  analysis. 


Factual  Information 


100 


Aircraft  Accident  Report 


According  to  Boeing’s  September  30,  1997,  submission,  three  of  the  hypothetical 
system-related  scenarios  (a  dual  slide  jam,  a  secondary  slide  jam  with  primary  slide 
overtravel,  and  an  input  linkage  jam)  and  one  hypothetical  flight  crew  input  scenario 
evaluated  during  the  investigation  all  “potentially  fit  a  kinematic  analysis.”  However,  with 
regard  to  the  three  hypothetical  system-related  scenarios,  Boeing’s  submission 
commented  that  “evidence  does  not  support  finding  as  probable  cause.  Boeing  s 
submission  further  stated  that  “there  is  no  evidence  to  support  a  conclusion  that  an 
uncommanded  full  rudder  defleetion  occurred.  While  there  is  no  evidence  of  a  crew- 
commanded,  sustained  left-rudder  input,  such  a  possibility  is  plausible  and  must  be 
seriously  considered,  especially  given  the  lack  of  evidence  of  an  airplane-induced  rudder 
deflection.” 

1.16.6.2  United  Flight  585  Simulation  Studies 

United  flight  585  was  flying  in  turbulent  air  while  making  a  right  turn  to  the  final 
approach  to  Colorado  Springs  Municipal  Airport.  Strong  winds  aloft  created  complex 
airflow  patterns  that  moved  from  west  to  east  across  the  mountains  located  west  of  the 
airplane’s  flightpath;  these  airflow  patterns  likely  included  strong  turbulence,  eddies, 
rotational  flow  fields,  and  crosswind  shear.  The  FDR  data  showed  that,  as  the  airplane  was 
descending  through  an  altitude  of  about  1,000  feet  agl  and  was  about  on  track  to  approach 
the  airport  from  the  south  (about  0943:32)'*',  its  heading  changed  to  the  right.  The 
airplane  impacted  the  ground  about  9  seconds  later.  The  airplane  s  orientation  and 
flightpath  angle  at  impact  were  near  vertical.  The  airplane  was  aligned  approximately  205° 
magnetic  heading,  and  the  ground  track  (as  defined  by  the  debris  field)  was  about  020° 
magnetic  heading.'*^ 

The  Safety  Board’s  workstation-based  simulator  for  a  737-200  airplane  was  used 
to  simulate  the  event.  The  simulation  process  used  available  FDR  data,  radar  data,  and 
information  on  the  aecident  location  and  airplane  orientation  at  impact.  Input  to  the 
simulation  for  engine  thrust  was  based  on  engine  sounds  recorded  on  the  CVR.  The  flight 
control  surface  position  time  histories  needed  for  the  simulation  were  not  among  the 
parameters  recorded  by  the  FDR  and  thus  had  to  be  estimated  or  derived.  The  control 
wheel  (aileron  and  spoilers),  rudder  surface,  and  elevator  position  time  histories  used  in 
each  simulation  were  derived  by  iteration. 

The  simulations  assumed  that  the  airplane  encountered  turbulence  with  a 
crosswind  gust  (perhaps  associated  with  a  mountain  rotor).***  In  the  Safety  Board  s  best- 
match  simulation  that  involved  a  rudder  movement  for  this  event,  these  winds  produced  a 
heading  change  and  yaw  rate  to  which  the  pilot  was  assumed  to  have  responded  (about 
0943:32)  with  left  rudder  pedal  input.'*"*  This  scenario  further  assumed  that  this  input 


All  times  in  this  subsection  are  mountain  standard  time,  based  on  a  24-hour  clock. 

The  heading  and  ground  track  were  about  180°  opposed  because  of  the  near-vertical  flightpath  angle. 

The  Safety  Board  considered  several  rotor  scenarios  in  its  studies,  including  moving  rotors  above, 
below  and  at  the  airplane’s  altitude;  standing  rotors  located  left,  right,  and  directly  along  the  airplane’s 
flightpath;  and  horizontal  rotors  that  transitioned  to  vertical  rotors  along  the  airplane’s  flightpath. 
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occurred  while  the  main  rudder  PCU  servo  valve  secondary  slide  was  jammed  to  the  servo 
valve  housing,  resulting  in  a  rudder  reversal  to  the  right. 

The  general  wind  field  was  derived  by  comparing  the  ground  track  from  the  radar 
data  with  the  airspeed  and  heading  data  from  the  FDR.  An  approximation  of  a  vertical  gust 
profile  was  developed  from  the  vertical  load  factor  data.  Crosswind  gust  components  were 
also  used  in  this  best-match  simulation. 

In  this  simulation,  at  0943:21,  when  the  airplane  was  nearly  aligned  with  the 
landing  runway,  the  airplane  began  to  experience  a  significant  heading  change  to  the  right. 
The  simulation  indicated  that  a  right  bank  angle  of  about  30°  was  required  to  produce  this 
heading  change.  The  Safety  Board  determined  that  the  heading  change  and  the  rolling 
moment  that  occurred  after  0943:21  were  likely  the  result  of  turbulence,  and  these  data 
became  the  baseline  for  the  turbulence  models  used  in  some  of  the  Board’s  simulations.'*^ 

Rudder  position  time  histories  were  developed  for  jams  of  the  secondary  slide  to 
the  servo  valve  housing  at  100,  71,  50,  40,  and  30  percent  from  the  neutral  position.  The 
rudder  position,  once  reversed,  was  assumed  to  remain  at  the  blowdown  limit'*^ 
corresponding  to  a  servo  valve  jam  at  the  100-percent  position  (blowdown  limit  is  partly 
dependent  on  jam  position,  airspeed,  and  sideslip  angle)  for  the  duration  of  the  reversal. 
The  timing  of  the  rudder  inputs  was  modified  by  iteration  until  the  simulation  produced 
heading  time  histories  consistent  with  the  FDR  data. 

The  heading  data  that  resulted  from  the  simulation  with  the  secondary  slide 
jammed  to  the  housing  at  100  percent  produced  the  Safety  Board’s  best-match  with  the 
FDR  heading  data.**"^  The  pilot  rudder  pedal  force,  rudder  surface,  and  control  wheel  time 
histories  for  the  100-percent  jam  are  presented  in  figures  22a  through  22c,  respectively.'** 
The  resultant  heading,  normal  load  factor,  pitch  angle,  and  bank  angle  data  for  the  Safety 
Board’s  100-percent  jam  solution  compared  with  the  FDR  data  are  presented  in  figures 
22d  through  22g,  respectively.  Roll  and  yaw  rate,  two  parameters  pertinent  to  human 


The  complete  data  sets  for  this  and  other  scenarios  can  be  found  in  the  Safety  Board’s  “United  flight 
585  Simulation  Study,”  dated  October  19,  1998,  and  the  Board’s  “Addendum  to  Simulation  Study,”  dated 
February  23, 1999, 

The  100-percent  jam  scenario  does  not  include  the  rotational  eddy  from  the  turbulence  model;  the 
30-percent  jam  (which  is  not  presented  in  this  report)  does  include  the  eddy. 

Because  of  fire  damage  to  the  United  flight  585  PCU,  the  Safety  Board  was  unable  to  perform 
laboratory  tests  to  determine  the  rudder  deflection  rate  and  the  hinge  moment  capability  of  the  PCU  with  the 
secondary  slide  jammed  at  various  positions  from  neutral.  Therefore,  data  from  the  US  Air  flight  427  PCU 
servo  valve  tests  in  which  the  secondary  slide  was  jammed  at  71,  50,  and  22  percent  from  neutral  were  used. 
Data  from  the  Eastwind  flight  517  PCU  servo  valve  tests  were  not  used  because  that  servo  valve  had  a  leaky 
bypass  valve. 

Because  of  the  reduced  hydraulic  pressure  ported  to  the  actuator  in  the  overtravel  situation,  this 
100-percent  jam  would  result  in  the  rudder  moving  at  a  reduced  rate  of  about  32°  per  second  to  the  reduced 
blowdown  limit. 

The  Safety  Board’s  best-match  simulation  used  300  pounds  of  force  reducing  to  200  pounds,  based 
on  ergonomic  and  other  research  data  (see  section  1.18.8).  The  Safety  Board  was  also  able  to  match  the 
United  flight  585  FDR  data  using  only  the  minimum  pedal  force  necessary  to  sustain  full  rudder  authority 
(about  70  pounds). 
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performance,  are  presented  in  the  figures  22h  and  221,  respectively,  for  the  100-percent 
jam  case  (figures  22i  and  22j).  CVR  data  are  presented  on  figures  22f,  22g,  and  22i  to 
correlate  verbal  responses  of  the-  pilots  to  simulated  pitch  angle,  bank  angle,  and  yaw  rate, 
respectively  Wind  direction  and  horizontal  and  vertical  windspeeds  used  in  the  Safety 
Board’s  best-match  scenario  are  presented  in  figures  22j  through  221,  respectively. 
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Figure  22a.  Pilot  rudder  pedal  force  positions  for  United  flight  585. 
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Figure  22j.  Wind  direction  for  United  flight  585. 
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Figure  22k-  Horizontal  windspeeds  for  United  flight  585. 
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Figure  221.  Vertical  windspeeds  for  United  flight  585. 


One  of  the  Safety  Board  simulation  scenarios  that  produced  a  good  match  with  the 
FDR  data  and  other  physical  evidence  assumed  a  sustained  equivalent  control  wheel  input 
to  the  right  with  no  rudder  input.  The  equivalent  control  wheel  input  could  represent  a 
pilot  command,  a  rotational  wind,  or  a  combination  of  the  two.  Figures  23a  through  23g 
show  the  resultant  data  for  rudder  surface  and  control  wheel  positions  and  heading,  normal 
load  factor,  calibrated  airspeed,  pitch  angle,  and  bank  angle  data,  respectively.  Figures  23f 
and  23g  also  show  CVR  data. 


Factual  Information 


109 


Aircraft  Accident  Report 


UAL  585 

Simulator  Study 


09:43:0.00  09:43:10.00  09:43:20.00  09:43:30.00  09:43:40.00  09:43:50.00 

Time  (hr:min:sec) 

Figure  23a.  Rudder  surface  positions  for  United  flight  585  assuming  a  sustained 

equivalent  control  wheel  input. 
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Figure  23b.  Control  wheel  surface  positions  for  United  flight  585  assuming  a  sustained 

equivalent  control  wheel  input. 
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Figure  23c.  Heading  data  for  United  flight  585  assuming  a  sustained 
equivalent  control  wheel  input. 


Time  (hr:min:sec) 

Figure  23d.  Normal  load  factor  for  United  flight  585  assuming  a  sustained 
equivalent  control  wheel  input. 
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Figure  23g.  Bank  angle  data  for  United  flight  585  assuming  a  sustained 
equivalent  control  wheel  input. 


In  a  June  23,  1997,  letter  to  the  Safety  Board,  Boeing  provided  its  analysis  of  the 
United  flight  585  accident.’*^  Boeing’s  analysis  concluded  that  a  rudder  hardover  scenario 
did  not  fit  the  FDR  data  and  that  a  “new  rotor  model”  did  match  the  data.'^”  Further, 
Boeing  derived  this  new  rotor  model  to  match  the  available  data  and  introduced  a 
rotational  effect  of  near  zero  just  before  0943:28,  which  increased  linearly  to  about  0.4 
radians  per  second  just  before  0943:29  and  then  increased  linearly  to  about  1.8  radians  per 
second  about  the  time  the  airplane  impacted  the  ground  (just  before  0943:42). 

Boeing’s  simulation  using  its  new  rotor  model  produced  the  data  shown  in  figures 
24a  through  24g  for  rudder  surface  positions,  windshear,  control  wheel  positions,  heading, 
bank  angle,  normal  load  factor,  and  pitch  angle,  respectively.  As  shown  in  figure  24c, 
Boeing’s  simulation  assumed  a  left  control  wheel  input  by  the  flight  crew  just  after 
0943:30. 


Boeing’s  analysis  was  resubmitted  to  the  Safety  Board  in  a  September  14,  1998,  letter. 

According  to  Boeing,  “the  new  rotor  model  is  significantly  different  from  that  evaluated  during  the 
original  [United  flight]  585  investigation.  The  original  [rotor]  model  was  a  solid  rotating  core  of  air  with  a 
distinct  boundary.  This  meant  that  the  air  at  the  outside  edge  of  the  core  was  at  a  very  high  velocity  for  large 
cores  with  high  rotational  velocity.  [Boeing’s  new  rotor]  model  is  not  a  solid  rotating  body,  but  has  a  velocity 
profile  which  varies  significantly  as  the  distance  from  the  center  core  increases.  The  model  was  developed 
based  on  a  simulation  of  the  weather  conditions  that  existed  in  the  Colorado  Springs  area  on  the  day  of  the 
accident.” 
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Boeing  Simulation  Match  UAL585 


Time  (hr:min:sec) 

Figure  24a.  United  flight  585  rudder  surface  positions  according  to 
Boeing’s  new  rotor  model. 
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Figure  24b.  Rotational  windshear  encountered  by  United  flight  585  according  to 

Boeing’s  new  rotor  model. 
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Boeing  Simulation  Match  UAL585 
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Figure  24c.  United  flight  585  control  wheel  positions  according  to 
Boeing’s  new  rotor  model. 


Figure  24d,  United  flight  585  heading  data  according  to 
Boeing’s  new  rotor  model. 
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Figure  24e.  United  flight  585  bank  angle  data  according  to 
Boeing’s  new  rotor  model. 
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Figure  24f.  United  fiight  585  normal  load  factor  data  according  to 
Boeing’s  new  rotor  model. 
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Boeing  Simulation  Match  UAL585 


Figure  24g.  United  flight  585  pitch  angle  according  to 
Boeing’s  new  rotor  model. 


1.16.6.3  Eastwind  Flight  517  Simulation  Studies 

Pilot  statements  and  data  from  Eastwind  flight  517  indicated  that  the  airplane  was 
flying  in  relatively  calm  air'^'  when  it  rolled  and  yawed  to  the  right.  The  event  lasted 
about  13  seconds.  Postincident  investigation  revealed  that  the  airplane’s  yaw  damper  had 
been  rigged  incorrectly  so  that  the  neutral  point  of  the  rudder  would  be  1.5°  to  the  left  if 
the  rudder  trim  knob  were  set  to  zero.  Ground  tests  and  measurements  indicated  that,  in 
this  incorrectly  rigged  condition,  a  yaw  damper  hardover  would  move  the  rudder  an 
additional  1.5°  to  the  left  or  4.5°  toward  the  right.  Flight  tests  conducted  in  the  Eastwind 
flight  517  airplane  indicated  that  compliance  within  the  rudder  system  would  reduce  the 
right  yaw  damper  authority  from  4.5  to  3.7°  (±  0.25°  error  band)  right  during  the  flight 
conditions  at  the  time  of  the  upset. 

The  Safety  Board’s  workstation-based  simulator  for  a  737-200  airplane  was  used 
to  simulate  the  events.  Input  to  the  simulation  for  engine  thrust  was  based  on  data  recorded 
on  the  FDR.  The  flight  control  surface  position  time  histories  needed  for  the  simulations 
were  not  among  the  parameters  recorded  by  the  FDR  and  thus  had  to  be  estimated  or 
derived.  With  the  use  of  a  detailed  Boeing  elevator  model,  the  elevator  input  was  derived 
from  the  control  column  position  recorded  by  the  FDR.  The  control  wheel  (aileron  and 
spoilers)  position  input  time  histories  were  initially  estimated  from  a  kinematic  analysis; 
the  final  control  wheel  position  time  histories  were  derived  by  iteration. 


Although  the  Eastwind  flight  517  FDR  data  showed  that  the  flight  was  mostly  smooth,  there  were 
two  positive  spikes  in  the  vertical  load  factor  of  about  1.2  Gs  about  45  and  5  seconds  before  the  event.  There 
were  coincident  signatures  in  the  longitudinal  load  factor  data. 
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For  the  rudder  position  time  history  input  in  the  Safety  Board’s  best-match 
simulation,  the  rudder  was  assumed  to  have  been  trimmed  to  its  zero  position  at  some  time 
before  the  roll  and  yaw  event  to  compensate  for  the  yaw  damper  offset.  (This  action  would 
result  in  the  trim  knob  being  positioned  about  1.5°  to  the  right,  which  is  the  position  where 
the  trim  knob  was  discovered  during  postincident  cockpit  documentation.)  The  Safety 
Board’s  best-match  simulation  also  assumed  a  rudder  input  similar  to  a  yaw  damper 
hardover  to  the  right  followed  by  a  left  rudder  pedal  input  by  the  pilots  to  counter  the  yaw 
from  this  rudder  input.  The  Board’s  simulation  scenario  then  assumed  that  a  rudder 
reversal  occurred  as  a  result  of  the  left  rudder  pedal  input  while  the  PCU  servo  valve 
secondary  slide  was  jammed  to  the  servo  valve  housing. 

Rudder  position  time  histories  were  developed  for  a  number  of  different 
conditions,  including  jams  of  the  secondary  slide  to  the  servo  valve  housing  at  100, 71,  55, 
43,  and  30  percent  from  the  neutral  position.  The  rudder  position,  once  reversed,  was 
assumed  to  remain  at  the  jam-reduced  blowdown  limit  (which  is  partly  dependent  on  jam 
position  within  the  servo  valve,  airspeed,  and  sideslip  angle)  for  about  13  seconds, 
consistent  with  the  period  of  heading  shift  recorded  by  the  Eastwind  flight  517  FDR 
during  the  incident.  The  timing  of  the  rudder  inputs  was  modified  by  iteration  until  the 
simulation  produced  heading  time  histories  consistent  with  the  FDR  data. 

The  simulation  assumed  that,  consistent  with  flight  crew  reports,  the  rudder  PCU 
servo  valve  became  unjammed  at  some  point,  enabling  the  captain  to  regain  control  of  the 
airplane.  Because  there  was  no  evidence  of  the  rudder  position  after  the  captain  regained 
control  of  the  airplane,  the  Safety  Board  considers  its  simulation  to  be  meaningful  only 
until  2210:42.  This  time  is  also  when  Boeing  terminated  the  data  in  its  simulations  that 
were  presented  in  its  August  14,  1998,  submission  supplement. 

The  heading  data  that  resulted  from  the  simulation  with  the  secondary  slide 
jammed  to  the  servo  valve  housing  at  the  55-percent  position  provided  the  best-match 
with  the  FDR  heading  data.  This  scenario  assumed  that  the  rudder  pedal  input  resulted 
in  a  rudder  reversal  and  rudder  movement'^'*  to  the  (reduced)  blowdown  limit  (6.5°) 
corresponding  to  the  55  percent  jam.'^^  Figure  25a  shows  the  right  and  left  EPR  settings 
recorded  by  the  FDR  and  those  used  in  the  Safety  Board’s  simulations.  The  control  wheel, 
pilot  rudder  pedal  force,  and  rudder  surface  time  histories  for  a  55-percent  jam  are  shown 
in  figures  25b  through  25d,  respectively.  The  resultant  roll  angle,  vertical  acceleration,  and 


See  Boeing’s  “Submission  Supplement  USAir  737-300  Accident  Near  Pittsburgh,”  dated  August  14, 

1998. 

The  Safety  Board’s  best-match  simulation  used  500  pounds  of  force  reducing  to  250  pounds,  then 
gradually  reducing  to  0  pounds,  based  on  ergonomic  and  other  research  data  (see  section  1.18.8).  The  Safety 
Board  was  also  able  to  match  the  Eastwind  flight  517  FDR  data  using  only  the  minimum  pedal  force 
necessary  to  sustain  full  rudder  authority  (about  70  pounds). 

Because  of  the  reduced  hydraulic  pressure  ported  to  the  actuator  in  the  overtravel  situation,  this 
55-percent  jam  would  result  in  the  rudder  moving  at  a  reduced  rate  of  about  15°  per  second. 

For  data  related  to  other  jam  scenarios,  refer  to  the  Safety  Board’s  “Eastwind  Rudder  Jam  Study, 
dated  June  5,  1998;  its  “Addendum  to  Eastwind  Rudder  Jam  Study,”  dated  November  11,  1998;  and  its 
“Addendum  2  to  Eastwind  Rudder  Jam  Simulation  Study,”  dated  February  18, 1999. 
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heading  data,  compared  with  the  FDR  data,  are  shown  in  figure  25e  through  25g, 
respectively.  Figure  25h  shows  the  simulator  heading,  corrected  for  gimbal  error, 
compared  with  the  FDR-recorded  heading  data  for  a  family  of  gyro  gimbal  spool-up 
angles  for  the  55-percent  jam  case.  Yaw  and  roll  rates  (parameters  pertinent  to  human 
performance)  are  presented  in  figures  25i  and  25j,  respectively,  for  the  55-percent  jam 
case. 


Eastwind  Event 

55%  Jam  Simulation  with  rudder  round-over 
varying  left  pedal  force  input  &  subsequent  release 


Eastern  Daylight  Time  (HH:MM:SS) 

Figure  25a.  Right  and  left  EPR  settings  for  Eastwind  flight  517. 
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Eastwind  Event 

55%  Jam  Simulation  with  rudder  round-over 


Figure  25b-  Control  wheel  positions  for  Eastwind  flight  517. 
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Figure  25c-  Pilot  rudder  pedal  force  for  Eastwind  flight  517. 
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Eastwind  Event 

55%  Jam  Simulation  with  rudder  round-over 
varying  left  pedal  force  input  &  subsequent  release 
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Figure  25d.  Rudder  surface  positions  for  Eastwind  flight  517. 


Eastwind  Event 

55%  Jam  Simulation  with  rudder  round-over 
varying  left  pedal  force  input  &  subsequent  release 


Figure  25e.  Roll  angle  data  for  Eastwind  flight  517. 
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Eastwind  Event 
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Figure  25f.  Normal  acceleration  data  for  Eastwind  flight  517. 
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Figure  25g.  Heading  data  for  Eastwind  flight  517. 
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Eastwind  Event 
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Figure  25h.  Heading  data  corrected  for  gimbal  error  for  Eastwind  flight  517. 


Eastwind  Event 

55%  Jam  Simulation  with  rudder  round-over 
varying  left  pedal  force  input  &  subsequent  release 


Figure  25i.  Yaw  rate  for  Eastwind  flight  517. 
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Eastwind  Event 

55%  Jam  Simulation  with  rudder  round-over 
varying  left  pedal  force  input  &  subsequent  release 
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Figure  25j.  Roll  rate  for  Eastwind  flight  517. 


Boeing’s  August  14, 1998,  submission  supplement  presented  four  scenarios  for  the 
Eastwind  incident  that  were  evaluated  using  Boeing’s  kinematic  analysis  and  computer 
simulations. In  its  submission  supplement,  Boeing  suggested  that  one  of  its  scenarios 
(number  4)  was  most  consistent  with  the  physical  evidence,  pilot  reports,  and  kinematic 
analysis.  Scenario  4  involves  a  preexisting  yaw  damper  hardover  condition  that  resulted  in 
a  rudder  surface  movement  to  3°  to  the  right,  which  the  pilots  compensated  for  with  3°  of 
left  rudder  trim.  According  to  this  scenario,  the  yaw  damper  hardover  condition  cleared 
itself  at  the  beginning  of  the  upset  event  (about  2210:28),  resulting  in  a  sudden  rudder 
movement  to  3.7°  to  the  left’’’  and  prompting  a  right  rudder  input  (just  after  2210:28)  by 
the  pilot(s),  which  resulted  in  the  rudder  moving  to  6°  to  the  right.  In  a  February  19, 1999, 
letter  to  the  Safety  Board,  Boeing  provided  “the  results  and  analysis  of  a  flight  test... in 
support  of  conclusions  made  in  [scenario  4  of  Boeing’s  submission  supplement].” 
Boeing’s  letter  included  a  rudder  plot  that  demonstrated  a  pilot  rudder  pedal  response 
within  '/4  second  after  the  yaw  damper  hardover  condition  cleared  (see  figures  26a 
through  26c). 


According  to  Boeing’s  submission  supplement,  scenario  1  involved  a  preexisting  left  yaw  damper 
hardover  with  a  subsequent  right  yaw  damper  hardover,  followed  by  a  small  nose-right  rudder  pedal  input; 
scenario  2  involved  a  right  yaw  damper  hardover  with  a  servo  valve  secondary  slide  jam  and  reversal; 
scenario  3  involved  a  preexisting  left  yaw  damper  hardover  with  a  subsequent  right  yaw  damper  hardover, 
plus  a  secondary  slide  jam  and  reversal;  and  scenario  4  involved  a  preexisting  right  yaw  damper  hardover 
that  subsequently  cleared,  and  the  resultant  yaw  damper  movement  prompted  a  right  rudder  pedal  input. 

The  3.7°  left  rudder  position  occurred  because  of  the  previous  left  rudder  trim,  the  misrigged  LVDT 
(see  section  1.16.1.2),  and  compliance  within  the  airplane’s  rudder  system. 
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Eastwind  Event 
Boeing  Solution 

from  fig  4  of  February  24,  1999  letter 
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Figure  26a.  Eastwind  flight  517  heading  data  according  to 
Boeing’s  scenario. 
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Figure  26b.  Eastwind  flight  51 7  pilot  rudder  pedal  force  according  to 

Boeing’s  scenario. 
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Eastwind  Event 
Boeing  Solution 

from  fig  4  of  February  24, 1999  letter 


Time  (hr:min:sec) 

Figure  26c.  Eastwind  flight  517  rudder  positions  according  to 
Boeing’s  scenario. 


In  Boeing’s  scenario,  the  pilots  subsequently  maintained  the  pressure  on  the  right 
rudder  pedal  and  used  left  control  wheel  and  differential  engine  power  to  maintain 
directional  control  until  the  roll  and  yaw  event  ended.  Boeing’s  August  1998  submission 
supplement  stated  the  following  regarding  scenario  4: 

The  airplane  rolls  to  the  left  during  the  initiation  of  the  event  and  matches 
the  heading  very  closely....  This  scenario  correlates  with  the  reported 
nearly  simultaneous  input  of  rudder  and  wheel  during  the  recovery....  [The 
captain’s]  usage  of  significant  rudder  input... is  consistent  with  the  manner 
in  which  [he]  used  rudder... during  flight  testing.  The  [captain’s]  stiff 
rudder  comment  may  have  been  caused  by  the  lack  of  expected  airplane 
response  to  the  significant  rudder  pedal  input  made  by  the  pilot.  The  only 
significant  discrepancy  with  the  pilot  report  is  the  direction  of  his  pedal 
command  and  his  report  that  there  was  no  yaw  to  the  left. 

Boeing’s  submission  supplement  also  stated  that  “the  yaw  damper  hardover  and 
recovery  proposed  in  scenario  4  does  match  the  flight  data  recorder  information.” 
According  to  Boeing’s  scenario  4,  the  yaw  damper  would  have  been  active  after  the  yaw 
damper  hardover  cleared  at  the  beginning  of  the  upset  event.  Boeing’s  estimated  rudder, 
yaw  damper  response,  and  rudder  command  is  shown  in  figures  27a,  and  Boeing’s 
estimated  rudder  with  pilot  command  and  no  yaw  damper  activity  is  shown  in  figure  27b. 
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Eastwind 

Boeing  Kinematic  Analysis 
Fig  1 1 ,  May  12,  1998  presentation 
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Figure  27a.  Boeing’s  kinematic  rudder  for  Eastwind  flight  517  and  rudder  with 
pilot  command  and  yaw  damper  activity. 
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Figure  27b.  Boeing’s  kinematic  rudder  for  Eastwind  flight  517  with  pilot  command 

and  no  yaw  damper  activity. 
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Figure  28a  presents  the  rudder  time  history  that  resulted  from  Boeing’s  kinematic 
analysis  of  scenario  4.  The  heading  time  history  that  Boeing  derived  from  its 
kinematically  developed  rudder  (uncorrected  for  what  Boeing  has  determined  to  be  a 
simulator  heading  error)  and  used  in  its  computer  simulations  is  shown  in  figure  28b. 
Figure  28c  shows  the  average  flight  test  heading  error,  and  28d  presents  the  “error 
corrected”  heading  time  history  compared  with  the  FDR  heading  data. 


Eastwind  Event 
Boeing  Solution 

from  fig  16  of  August  14, 1998  submittal 


Figure  28a.  Eastwind  flight  517  rudder  positions  according  to  Boeing’s  scenario. 
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Eastwind  Event 
Boeing  Solution 


Figure  28b.  Eastwind  flight  517  heading  data  according  to  Boeing’s  scenario. 


Eastwind  Event 
Boeing  Solution 

from  fig  16  of  August  14, 1998  submittal 


Figure  28c.  Eastwind  flight  517  average  flight  test  heading  error  according  to 

Boeing’s  scenario. 
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Eastwind  Event 
Boeing  Solution 


Figure  28d.  Eastwind  flight  517  corrected  heading  according  to  Boeing’s  scenario. 


Boeing’s  submission  supplement  concluded  that  “multiple  scenarios  have  been 
identified  that  match  at  least  some  of  the  data  and  crew  reports  from  the  Eastwind  517 
event.  None  of  the  scenarios  fully  match  all  the  data,  kinematic  analysis,  and  crew 
reports.”  The  submission  supplement  also  included  Boeing’s  belief  that,  “...under  the 
NTSB  standard  for  identifying  ‘probable  cause,’  there  is  insufficient  data  to  find  a 
‘probable  cause’  for  this  event.” 

1.16.7  Identification  of  CVR  Sounds/Sound  Spectrum  Analysis 

During  the  examination  of  the  CVR  recording  from  the  USAir  flight  427  airplane, 
the  CVR  Group  members  noted  several  sounds  that  occurred  during  the  initial  upset  and 
descent  into  terrain  that  they  were  initially  unable  to  identify  or  explain.  These  sounds 
were  as  follows: 

•  sound  similar  to  three  thumps  (at  1902:56.547, 1902:56.72,  and  1902:56.855); 

•  sound  of  electrical  impulse  recorded  on  the  captain’s  radio  channel 
(at  1902:56.9); 

•  sound  of  two  thumps  (at  1902:58.2  and  1902:59.2); 

•  sound  similar  to  airplane  engines  increasing  in  loudness  (at  1902:58.27); 

•  sound  of  “clickety  click”  (at  1902:58.6  and  1902:59.5);  and 

•  sound  of  wailing  horn  (at  1903:02.1). 
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To  identify  the  sources  of  the  sounds,  the  Safety  Board  examined  the  recording  on 
a  spectrum  analyzer,  which  gives  a  visual  presentation  of  the  frequency  content  of  the 
signals,  and  a  computer  signal  analyzer,  which  allows  detailed  analyses  of  the  analog 
waveform,  frequency  content,  and  detailed  timing  information.  (Additionally,  at  Boeing  s 
request,  the  Safety  Board’s  Sound  Spectrum  Group  conducted  an  additional  review  of  the 
CVR  sounds  with  Boeing  flight  test  and  system  design  engineers  participating;  no 
additional  information  was  gained  as  a  result  of  this  review.) 

When  Safety  Board  investigators  compared  the  CVR  sounds  from  USAir  flight 
427  with  CVR  sounds  obtained  from  known  in-flight  explosions,  no  similarities  were 
noted.  The  Safety  Board  also  provided  the  original  CVR  recording  to  the  FBI’s  forensic 
audio  laboratory  in  Quantico,  Virginia,  which  examined  the  recording  to  identify  any 
unusual  sounds  or  signatures  that  might  be  associated  with  criminal  or  terrorist  activity. 
The  laboratory  discovered  no  sounds  that  appeared  to  result  from  explosions,  gun  shots,  or 
any  other  identifiable  acts  of  violence. 

1.16.7.1  Sounds  Similar  to  Thumps  (Three  Initial  Thumps  Within  1  Second 
and  Two  Subsequent  Thumps  About  1  Second  Apart) 

Beginning  at  1902:56.5,  the  accident  airplane’s  CVR  recorded  a  sound  on  the 
CAM  ehannel,  which  investigators  characterized  as  similar  to  three  thumps  within 
1  second.  Simultaneously,  the  CVR  recorded  an  eleetrical  impulse  (when  plotted,  this 
impulse  showed  itself  as  a  voltage  spike)  on  the  captain  s  channel  (see  section  1.16.7.2). 
These  sounds  were  followed  by  two  additional  thump  sounds,  about  1902:58.2  and 
1902:59.2.  Examination  of  the  entire  31 -minute  CVR  recording  revealed  that  the  CVR 
had  not  recorded  anything  similar  to  the  thump  sounds  during  the  previous  30V2  minutes. 
Examination  of  each  of  the  thump  sounds  using  the  spectrum  analyzer  and  computer 
signal  analyzer  revealed  that  the  sounds  exhibited  frequency  signatures  with  most  of  their 
energy  in  the  low-frequency  (below  500  Hz)  range.  The  “impulse”  type  of  sound  that  is 
usually  formed  when  two  hard  surfaces  strike  each  other  contains  energy  distributed 
equally  through  a  large  range  of  frequencies. 

Because  investigators  were  initially  unable  to  identify  the  source  of  these  thump 
sounds,  and  because  of  the  circumstances  of  the  accident,  the  Safety  Board  devised  a  test 
to  document  the  effects  (and  sounds)  of  rudder  cable(s)  breaking.  As  previously  discussed, 
the  sounds  recorded  by  the  CVR  during  these  tests  were  impulsive  in  nature,  with  energy 
distributed  throughout  the  frequency  spectrum.  (See  section  1.16.5.2  for  details  of  the 
rudder  cable  break  tests.) 

Because  the  sounds  were  recorded  by  both  the  CAM  and  the  jumpseat/observer 
channels  of  the  CVR,  indicating  that  the  sounds  could  have  been  transmitted  to  those 
microphones  through  the  air  and/or  through  the  airplane’s  metal  structure,  the  Safety 
Board  conducted  tests  to  derive  the  source  and  relationship  of  the  thump  sounds.  A  test 
737-300  was  configured  to  represent  the  accident  airplane’s  condition  at  the  time  the 
thump  sounds  were  recorded:  the  cabin  and  cockpit  doors  were  closed,  the  jumpseat/ 
observer  position  oxygen  mask  was  stowed  properly,'^*  the  CAM  was  positioned  in  the 
same  location  as  in  the  accident  airplane,  and  two  crew  microphones  were  used. 
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Investigators  then  struck  the  airplane  structure  at  various  locations  (inside  and  outside) 
with  a  rubber  mallet  and  moved/bumped  service  equipment  within  the  cabin,  with  the 
CVR  recording  the  resultant  sounds. 

Examination  of  the  CVR  recording  from  the  tests  revealed  that  the  rubber  mallet 
impact  sounds  were  recorded  by  each  microphone  as  two  distinct  events;  in  both  cases,  the 
first  recorded  event  was  the  sound  transmitted  through  the  airplane  structure,  and  the 
second  was  the  sound  that  was  transmitted  through  the  air.  The  time  difference  between 
the  recorded  sounds  for  any  given  mallet  strike  corresponded  directly  to  the  distance 
between  the  microphone  and  the  location  of  that  mallet  strike.  Further,  investigators  noted 
that  the  sound  signals  would  arrive  first  at  the  microphone  closest  to  the  mallet  strike. 
Thus,  it  was  possible  to  calculate  the  approximate  distance  and  direction  to  the  source  of 
the  sounds.  Reexamination  of  the  thump  sounds  recorded  by  the  accident  CVR,  in  relation 
to  the  sounds  recorded  by  the  CVR  recording  from  the  tests,  revealed  that  the  accident 
CVR  recorded  sounds  consistent  with  a  sound  from  a  source  approximately  12  to  16  feet 
back  from  the  CAM  (corresponding  to  the  fuselage  area  about  the  location  of  passenger 
seat  row  1  or  2).  Although  the  rubber  mallet  strike  tests  could  duplicate  the  timing  of  the 
thump  sounds,  the  sound  signatures  produced  during  the  tests  (whether  from  mallet 
strikes,  jumping  in  the  cabin,  or  movement  of  cabin  service  equipment)  were  distinctly 
different  from  those  recorded  by  the  accident  CVR. 

The  pilots  who  participated  in  the  wake  turbulence  encounter  test  flights  reported 
that,  under  some  flight  test  conditions,  they  heard  sounds  in  the  cockpit  that  they 
associated  with  the  wake  turbulence  encounters.  The  pilots  described  the  sounds  as 
“whooshing”  sounds  and  stated  that  they  were  usually  heard  during  the  test  conditions  in 
which  the  main  fuselage  passed  through  the  center  of  the  wake  core.  The  Sound  Spectrum 
Group  compared  the  CVR  sounds  from  USAir  flight  427  with  the  CVR  sounds  recorded 
during  the  wake  turbulence  flight  tests  and  noted  that  the  sounds  recorded  during  some  of 
the  wake  encounters  were  very  similar  in  frequency,  energy,  and  timing  to  the  thumps 
recorded  by  the  accident  CVR. 

1.16.7.2  Sound  of  Electrical  Impulse  Recorded  on  the  Captain’s 
Radio  Channel 

At  1902:56.9,  an  electrical  impulse  (a  voltage  spike)  of  unknown  origin  was 
recorded  on  the  captain’s  radio  channel.  The  duration  of  the  voltage  spike  was  measured  to 
be  0.0068  seconds.  Further  examination  of  the  voltage  spike  revealed  that  it  was 
composed  primarily  of  two  frequencies  (2818  and  400  Hz)  superimposed  on  one  another. 
Safety  Board  investigators  subjected  a  representative  CVR  installation  to  a  test  series  of 


For  additional  information  regarding  the  jumpseat/observer  position  oxygen  mask,  see  section 

1.11.1. 

The  thump  sounds  on  the  accident  airplane’s  CVR  were  not  recorded  on  either  pilots’  channel. 
Investigation  revealed  that  both  pilots  wore  headsets  with  boom  microphones  that  were  wired  “hot”  to  the 
CVR.  According  to  the  manufacturer,  the  microphones  were  designed  to  pick  up  voice  frequencies  and 
suppress  most  background  noises.  Further,  the  microphones  would  not  be  sensitive  to  sounds  transmitted 
through  the  airplane  structure  because  they  were  isolated  from  the  structure  by  the  human  body. 
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disturbances,  including  electrical  field,  magnetic  field,  induced  voltage  spike,  radio 
frequency  susceptibility,  over-  and  undervoltage  transients,  power  interruptions,  and  high 
voltage  induced  transients  (simulating  lightning  strikes).  The  CVR  recording  from  the  test 
revealed  that,  although  some  of  the  test  conditions  induced  voltage  spikes  and  noise  on  the 
CVR  recording,  none  of  the  spikes  resembled  the  voltage  spike  recorded  by  the  accident 
CVR.  However,  during  the  testing,  investigators  noted  that  activation  of  a  radio/intercom 
selector  switch  in  the  intercom  position  produced  a  voltage  spike  nearly  identical  to  the 
spike  recorded  by  the  accident  CVR.  The  spring-loaded  radio/intercom  selector  switch  on 
the  radio  selector  panel  is  located  outboard  of  the  pilots’  knees  in  the  cockpit. 

1.16.7.3  Sound  Similar  to  Airplane  Engines  Increasing  in  Loudness 

A  review  of  the  sound  signatures  associated  with  the  rotating  engines  recorded  by 
USAir  flight  All's  CVR  revealed  that,  throughout  the  31-minute  CVR  recording,  the 
engine’s  sound  signatures  changed  in  frequency  as  the  engine  speed  increased  or 
decreased^^*^  but  remained  constant  in  intensity  (volume).  During  the  upset  sequence,  the 
CAM  channel  of  the  accident  CVR  also  recorded  variations  in  the  volume  of  the  sound 
signatures  associated  with  the  engines.  The  sound  spectrum  study  indicated  that,  at 
1902:58.27  and  1903:02.3,  the  sounds  on  the  CVR  recording  that  were  associated  with 
both  engines  simultaneously  increased  in  volume  by  about  30  percent;  at  the  same  time, 
the  frequency  of  the  engine  sound  signatures,  and  the  volume  of  all  other  background 
noises,  remained  constant.  The  first  increase  signature  occurred  about  0.17  seconds  after 
the  first  thump  in  the  second  set  of  thump  sounds;  the  second  increase  occurred  about 
1  second  later,  just  before  the  captain  exclaimed  “hang  on.”  Although  FDR  data  indicated 
that  the  engine  power  settings  changed  during  the  accident  sequence,^”^  the  engine  sounds 
(when  identifiable)  remained  at  the  increased  volume  throughout  the  remainder  of  the 
CVR  recording. 

The  Safety  Board  attempted  to  determine  why  the  volume  of  the  engine  sound 
signatures  increased  in  a  manner  that  did  not  correspond  to  FDR-recorded  changes  in 
engine  power  setting  during  the  upset  sequence.  The  Board  considered  the  following 
possibilities:  the  ability  of  the  CVR  recording  system  to  pick  up  these  sounds  had 
increased;  the  sound  transmission  path  between  the  engines  and  the  CVR  area  microphone 
had  changed;  and  the  amount  of  engine  inlet  fan  noise  had  increased.  The  Safety  Board 
could  not  identify  any  physical  or  electrical  phenomena  that  would  account  for  an  increase 
in  the  ability  of  the  CVR  recording  system  to  record  the  volume  of  the  engine  sound 
signatures,  while  sound  signatures  at  all  other  frequencies  remained  unchanged,  as  they 
did  in  the  accident  airplane’s  CVR  recording.  The  engine  noise  volume  increase  affected 


Examination  of  these  sound  signatures  revealed  two  distinct  traces,  one  being  slightly  higher  in 
frequency  than  the  other.  Review  of  the  FDR  data  revealed  that  the  right  engine  fan  speed  (Nl)  was 
operating  at  1  to  3  percent  higher  revolutions  per  minute  than  the  left  engine  fan  speed.  This  difference 
coincided  with  the  difference  in  engine  fan  speeds  calculated  from  the  CVR  engine  sound  signatures. 

The  FDR  data  indicated  that,  after  a  brief  increase  in  engine  power  setting  at  1903:02,  the  engine 
power  settings  began  to  decrease  from  the  peak  power  setting  recorded  during  the  accident  sequence  (about 
80  percent  Nl);  by  1903:09,  the  engine  power  settings  had  decreased  to  about  30  percent  Nl,  at  which  point 
they  remained  until  ground  impact. 


Factual  Information 


133 


Aircraft  Accident  Report 


both  engines  equally  and  symmetrically,  and  the  accident  CVR  did  not  record  an  increase 
in  background  wind  noise.  In  other  accident  investigations, the  Safety  Board  observed 
that  a  change  in  the  engines’  sound  transmission  path  because  of  a  change  in  the  airplane’s 
structure  (loss  of  a  fuselage  panel  or  a  cabin  door  opening  in  flight)  was  accompanied  by  a 
dramatic  increase  in  background  wind  noise.  No  such  increase  in  background  wind  noise 
was  recorded  by  the  USAir  flight  427  CVR.  The  Safety  Board’s  review  of  CVR 
information  from  previous  investigations  yielded  several  occurrences  (such  as  a  bird  strike 
or  a  loss  of  engine  cowling  structure)  that  affected  the  amount  of  inlet  fan  noise  that  one  of 
the  engines  produced.  However,  these  occurrences  on  previous  accidents  did  not  affect 
both  engines  equally  and  simultaneously. 

Safety  Board  investigators  also  examined  a  representative  sample  of  the  CVR 
recordings  from  the  wake  vortex  flight  tests^®^  (discussed  in  section  1.16.2)  in  an  attempt 
to  identify  any  potential  relationship  between  crossing  a  wake  vortex  and  the  engine  sound 
signature  recorded  by  the  CVR.  None  of  the  sampled  CVR  recordings  showed  any 
significant  change  in  the  engine  sound  signatures  as  a  result  of  the  wake  encounters. 

During  a  series  of  flight  tests  on  the  737-300  conducted  by  the  Safety  Board  in 
September  1995  to  evaluate  flight  control  characteristics  and  validate  and  expand 
Boeing’s  737  mathematical  simulator  model,  the  instrumented  airplane  was  subjected  to 
several  full  rudder  deflection  and  maximum  rate  aileron  roll  maneuvers.  During  postflight 
examination  of  the  audio  recordings  from  these  flights.  Safety  Board  investigators 
observed  that,  during  some  of  the  maneuvers,  the  engine  sound  signatures  increased  in 
volume,  similar  to  the  volume  increases  that  were  observed  on  the  accident  CVR 
recording.  The  airplane  maneuvers  that  resulted  in  such  changes  to  the  engine  sound 
signatures  included  large  rudder  displacements  (both  right  and  left)  at  various  angles  and 
rates  in  which  flight  test  pilots  utilized  opposite  aileron  to  limit  rudder-induced  bank  angle 
(steady  heading  sideslip)  and  rudder-only  flight  control  input  (both  right  and  left)  at 
various  rudder  displacement  angles  and  rates.  The  test  maneuvers  in  which  large  and  rapid 
rudder  displacements  were  applied  resulted  in  the  greatest  change  in  engine  sound 
signature  intensity.  When  the  CVR  recordings  from  the  flight  tests  were  compared  with 
the  CVR  recording  from  the  USAir  flight  427  airplane,  the  best  match  was  with  the  flight 
test  condition  involving  rapid  rudder  input  from  0  to  14°  rudder. 


See  National  Transportation  Safety  Board.  1990.  Aloha  Airlines  Flight  243,  In-flight  Structural 
Failure,  near  Maui,  Hawaii,  April  28,  1988.  Aircraft  Accident  Report  NTSB/ AAR-89/03.  Washington,  DC. 
Also  see  National  Transportation  Safety  Board.  1990.  United  Airlines  Flight  811,  In-Flight  Cargo  Door 
Separation,  near  Honolulu,  Hawaii,  February  24,  1989.  Aircraft  Accident  Report  NTSB/AAR-90/01. 
Washington,  DC. 

Fourteen  encounters  were  selected  for  this  examination;  these  selections  were  considered 
representative  of  wake  vortex  penetrations  from  all  the  various  entry  angles  and  trailing  distances  behind  the 
wake-producing  airplane. 
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1.16.7.3.1  Comparison  of  Engine  Sound  Signatures  From  the 
United  Flight  585  CVR  and  a  CVR  From  737-200  Flight  Tests 

Because  of  the  Safety  Board’s  findings  (discussed  in  section  1.16.7.3)  that  certain 
sideslip  and  yaw  maneuvers  in  a  737-300  could  result  in  changes  in  engine  sound 
signatures,  investigators  next  attempted  to  determine  whether  such  maneuvers  in  a 
737-200  would  result  in  similar  changes  in  engine  sound  signatures  and,  if  so,  whether  any 
such  changes  could  be  discerned  on  the  United  flight  585  CVR.^*^  According  to  Boeing, 
the  overall  geometry  and  proportions  of  the  737-200  and  -300  series  fuselages  are  very 
similar;  however,  the  airplanes  are  equipped  with  significantly  different  engines.  The 
737-200’s  engines  are  equipped  with  inlet  vanes  or  diffusers  that  intentionally  make  the 
inlet  airflow  turbulent.^®^  Therefore,  investigators  recognized  the  possibility  that 
maneuvers  causing  the  inlet  airflow  to  be  slightly  more  turbulent  might  not  produce 
significant  change  in  the  engine’s  noise-producing  characteristics. 

On  June  3,  1996,  the  Safety  Board  conducted  an  engine  perturbation  flight  test 
using  a  United  Airlines  737-200  at  the  United  Airlines  Maintenance  Operations  facility  in 
Indianapolis,  Indiana.  The  flight  test  consisted  of  airplane  maneuvers  similar  to  those 
conducted  during  737-300  flight  control  characteristics  testing  in  September  1995.  (See 
section  1.16.4.)  The  CVR  recordings  of  the  737-200  flight  test  during  sideslip  and  yaw 
conditions  revealed  engine  sound  signature  changes  similar  to  those  heard  in  the  737-300 
flight  test  CVR  recordings  for  the  same  conditions. 

The  CVR  recording  from  United  flight  585  was  compared  with  the  CVR  recording 
from  the  737-200  flight  test.  However,  analysis  of  the  engine  sounds  on  the  United  flight 
585  CVR  was  hampered  by  two  factors:  the  recording  was  of  poor  quality  with  obscuring 
background  noise  and  the  pilots  of  United  flight  585  were  changing  the  engine  power 
settings — and  therefore,  varying  the  revolutions  per  minute  frequency — almost  constantly 
during  the  approach  to  land.  Investigators  attempted  to  compensate  for  these  factors  when 
possible  and  then  extracted  and  plotted  the  resulting  engine  sounds.  Further,  investigators 
plotted  the  FDR  data  (heading,  altitude,  vertical  Gs,  and  indicated  airspeed)  along  with  the 
CVR  data.  No  changes  in  engine  sound  volume  were  detected  on  the  United  flight 
585  CVR. 

1.16.7.4  Sounds  of  “Clickety  Click” 

During  public  hearing  testimony,  Boeing’s  flight  test  pilot  speculated  that  the 
clickety  click  sounds  might  have  been  caused  by  the  windshield  wipers  “chattering”  or 
“slapping”  on  the  windshield  as  the  wake  vortex  impacted  the  airplane’s  fuselage.  He 


The  Safety  Board  would  have  attempted  to  apply  the  same  techniques  to  the  CVR  recording  from  the 
Eastwind  flight  517  incident,  which  also  involved  a  737-200;  however,  the  30-minute  CVR  tape  continued 
to  run  after  the  airplane  landed,  and  the  relevant  portion  of  the  flight  was  recorded  over. 

According  to  the  engine  manufacturer,  the  engines  installed  on  the  737-200  series  airplane  were 
designed  when  controlling/reducing  inlet  noise  was  not  a  critical  issue  for  manufacturers.  Because  of  the 
differences  in  engine  inlet  design,  the  engines  installed  on  the  737-200  series  airplanes  produced  more  noise 
than  the  engines  installed  on  the  737-300  series  airplanes. 
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stated  that  when  the  wake  core  hit  the  fuselage,  “it  actually  lifted  the  windshield  wiper 
perpendicular  off  the  wind  screen  and  then  it  popped  back  with  a  rather  subtle  clicking 
noise.”  The  Safety  Board  was  unable  to  find  a  sound  on  the  wake  turbulence  flight  test 
CVR  recordings  that  matched  the  clickety-click  sounds  recorded  by  the  accident  CVR  at 
1902:58.6  and  1902:59.5. 

1.16.7.5  Sound  of  Wailing  Horn 

Although  the  wailing  horn  sound  that  was  recorded  by  the  USAir  flight  427  CVR 
was  originally  identified  as  being  “similar  to  autopilot  disconnect,”  further  investigation 
revealed  that  the  wailing  horn  recorded  by  the  accident  CVR  did  not  sound  the  way  the 
autopilot  disconnect  aural  warning  was  designed  to  sound.  According  to  Boeing 
engineers,  the  autopilot  aural  warning  is  generated  by  sweeping  electronic  sound 
oscillators  from  low  to  high  frequency,  resulting  in  a  sound  that  is  described  in  Boeing 
literature  as  a  “fast  wailer.”  The  aural  warning  is  designed  to  continue  to  cycle  every 
second  for  as  long  as  the  horn  is  activated.  On  the  accident  CVR  recording,  the  wailing 
horn  started  as  a  fast  wailer  but,  after  one  cycle,  lapsed  into  a  fast-cycle  warbling  tone, 
which  continued  to  the  end  of  the  recording. 

Investigation  revealed  that  the  unit  that  generated  the  autopilot  disconnect  aural 
warning  on  the  accident  airplane  also  generated  most  of  the  cockpit  aural  warnings.  The 
unit  was  equipped  with  multiple  sound  oscillators  and  bells  and  generated  aural  warnings, 
in  addition  to  autopilot  disconnect,  for  engine  fire,  loss  of  pressurization,  aircraft 
overspeed,  and  takeoff/landing  conditions.  The  unit  was  designed  with  a  warning  priority 
schedule — when  a  warning  is  being  sounded  and  a  warning  with  a  higher  priority  is 
sensed,  the  unit  will  stop  the  lower  priority  warning  and  sound  the  higher  priority  warning. 

The  Safety  Board  conducted  tests  on  a  USAir  737-300  that  was  equipped  similarly 
to  the  accident  airplane.  These  tests  revealed  that,  when  the  autopilot  disconnect  and 
landing  gear  wamings^®^  were  sounded  simultaneously,  the  test  airplane  unit  produced  a 
cockpit  aural  warning  that  appeared  to  mix  the  steady  landing  gear  warning  tone  with  the 
wailing  autopilot  disconnect  horn,  producing  a  warbling  tone  centered  around  the  landing 
gear  warning  tone — similar  to  the  aural  warning  recorded  by  the  accident  airplane’s  CVR. 
However,  when  the  test  airplane  unit  was  examined  on  a  test  bench,  all  warnings  were 
within  specification,  and  the  warning  priority  specifications  functioned  in  a  manner 
consistent  with  their  design.  Further  examination  revealed  that  unintended  mixing  of  aural 
warnings  can  result  from  incomplete-electrical  grounding  of  the  warning  system. 

1.16.8  Study  of  Pilots’  (USAir  Flight  427  and  United  Flight  585) 
Speech,  Breathing,  and  Other  CVR-recorded  Sounds 

As  part  of  its  investigation  of  the  USAir  flight  427  accident,  the  Safety  Board 
examined  the  pilots’  speech  (voice  fundamental  frequency,  or  pitch;  amplitude,  or 


According  to  Boeing  representatives,  the  landing  gear  warning  can  be  activated  when  one  or  both 
throttles  are  retarded  to  idle  and  the  landing  gear  is  not  extended. 
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loudness;  speaking  rate;  and  content)  and  breathing  (inhaling,  exhaling  and  grunting) 
patterns  recorded  by  the  CVR  during  the  routine  portions  of  the  flight,  the  initial  upset, 
and  the  uncontrolled  descent.  Investigators  extracted  several  acoustical  measures  of 
speech  (fundamental  frequency,  amplitude,  and  speaking  rate)  from  pilot  statements  on  the 
CVR  recording  to  understand  the  actions  and  emotional  states  of  the  pilots  during  the 
accident  sequence.^®^  Similar  speech  analysis  techniques  have  been  used  previously  by 
Russian,  Japanese,  and  Australian  investigative  and  research  authorities^®^  and  by  Safety 
Board  investigators  on  three  occasions  before  this  investigation.^®® 

The  Safety  Board  reviewed  the  USAir  flight  427  CVR  for  pilot  speech  samples 
appropriate  for  computer  speech  analysis.  The  Safety  Board  observed  that  the  captain 
spoke  the  airplane’s  call  sign,  “four  twenty  seven,”  during  routine  and  emergency  radio 
transmissions,  providing  a  basis  for  direct  comparison  using  the  same  words.  When  the 
captain  spoke  the  phrase  “four  twenty  seven”  during  routine  flight  operations,  the  average 
fundamental  frequency  value  was  144.6  Hz.  However,  when  the  captain  stated  four  twenty 
seven  about  1903:15  during  the  emergency  descent,  the  speech  fundamental  frequency 
increased  47  percent,  to  214  Hz.  Figure  29  graphs  the  fundamental  frequency  measures 
obtained  for  the  captain’s  statements  before  and  during  the  upset  period,  showing  changes 
in  the  fundamental  frequency  of  his  speech  as  the  emergency  situation  developed.^'® 
Figure  30  graphs  the  amplitude  measures  obtained  for  the  same  statements.  According  to 
scientific  literature,^**  fundamental  frequency,  amplitude,  and  speaking  rate  tend  to 
increase  in  response  to  increased  psychological  stress. 

The  captain’s  speech  fundamental  frequency  during  the  3  minutes  before  the  initial 
upset  event  generally  ranged  between  127  and  148  Hz  and  then  increased  to  210  Hz  when 
he  stated  “sheeez.”  Additionally,  the  captain’s  amplitude  during  the  3  minutes  before  the 
upset  event  ranged  between  237  and  520  volts^*^  and  then  increased  to  904  volts  when  he 


See  “Speech  Examination  Factual  Report,  May  5,  1997”  for  details  on  the  extraction  procedures, 
which  employed  computer  analysis. 

For  additional  information,  see  Brenner,  Malcolm,  Mayer,  David,  and  Cash,  James  [NTSB].  “Speech 
Analysis  in  Russia.”  In  Methods  and  Metrics  of  Voice  Communications.  1996.  Ed.  B.G.  Kanki  and  O.V. 
Prinzo.  Washington,  DC:  Department  of  Transportation,  Federal  Aviation  Administration,  Office  of  Aviation 
Medicine,  DOT/FA  A/ AM-96/ 10.  Also  see  Mayer,  David  L.,  Brenner,  Malcolm,  and  Cash,  James  R. 
[NTSB].  “Development  of  a  Speech  Analysis  Protocol  for  Accident  Investigation.”  In  Methods  and  Metrics 
of  Voice  Communications.  1996.  In  addition,  see  Aircraft  Accident  Investigation  Report  [Japan],  Japan  Air 
Lines  Co.,  Ltd.,  Boeing  747  SR- 100,  JA8119,  Gunman  Prefecture,  Japan,  August  12, 1985  and  Bureau  of  Air 
Safety  Investigation  Accident  Investigation  Report,  Mid-Air  Collision  Between  Cessna  172-N  VH-HIZ  and 
Piper  PA38-112  VH-MHQ,  near  Tweed  Heads,  New  South  Wales,  20  May  1988  (BASI  Report  881/1042). 

^  For  additional  information,  see  NTSB  Aircraft  Accident  Reports  FrW91FA144  and  SEA95FA175. 
Also  see  National  Transportation  Safety  Board.  1990.  Grounding  of  the  U.S.  Tankship  EXXON  VALDEZ  on 
Bligh  Reef  Prince  William  Sound  near  Valdez,  Alaska,  March  24,  1989.  Marine  Accident  Report 
NTSB/MAR-90/04.  Washington,  DC.  In  addition,  see  Brenner,  M.,  and  Cash,  J.  1991.  “Speech  Analysis  as 
an  Index  of  Alcohol  Intoxication — ^The  Exxon  Valdez  Accident.”  Aviation,  Space,  and  Environmental 
Medicine,  62,  893-98. 

Only  those  statements  that  were  free  of  artifacts  caused  by  background  conversation  or  other  sounds 
appear  on  this  graph  and  the  one  in  figure  30.  Of  the  three  measured  aspects  of  the  captain’s  speech, 
fundamental  frequency  provided  the  most  measurable  data.  Missing  data  precluded  similar  measurements  of 
the  captain’s  speech  rate  or  amplitude. 
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stated  “sheeez.”  (The  captain’s  speech  amplitude  reached  its  maximum  measured  value  of 
2,865  volts  at  1903:18.1  during  the  emergency  descent.)  Review  of  the  first  officer’s 
speech  during  the  accident  flight  revealed  that  he  did  not  speak  enough  during  the 
emergency  period  to  provide  a  basis  for  meaningful  analysis. 

The  Safety  Board  conducted  a  similar  laboratory  speech  analysis  examination  of 
the  speech  and  other  sounds  recorded  by  the  United  flight  585  CVR.  The  only  measurable 
data  obtained  during  this  examination  was  for  speech  fundamental  frequency.^'^  The 
captain’s  speech  fundamental  frequency  when  he  spoke  the  word  “flaps”  during  routine 
and  emergency  radio  transmissions  provided  a  basis  for  direct  comparison.  When  the 
captain  said  “flaps”  during  routine  flight  operations,  his  speech  exhibited  an  average 
fundamental  frequency  of  131  Hz.  However,  when  the  captain  stated  “flaps”  at  0943:33.5 
during  the  upset  event,  the  fundamental  frequency  of  his  speech  had  increased  77  percent, 
to  233  Hz. 


See  Ruiz,  R.,  Legros,  C.,  and  Guell,  A.  1990.  “Voice  analysis  to  predict  the  psychological  or  physical 
state  of  a  speaker.”  Aviation,  Space,  and  Environmental  Medicine,  61,  266-71.  Also,  see  Brenner,  M., 
Doherty,  E.T.,  and  Shipp,  T.  1994.  “Speech  measures  indicating  workload  demand.”  Aviation,  Space,  and 
Environmental  Medicine,  65:21-26. 

Amplitude  is  often  measured  in  decibels,  a  logarithmic  scale  determined  relative  to  an  internationally 
accepted  calibration  standard.  Because  no  calibration  standard  was  available  in  the  CVR  recording, 
amplitude  was  measured  in  volts  (the  direct  measure  of  physical  intensity)  and  plotted  on  a  logarithmic  scale 
for  convenience. 

Amplitude  could  not  be  measured  because  of  the  automatic  gain  control  feature  on  the  microphone. 
Speech  rate  could  not  be  measured  because  of  the  limited  amount  of  speaking  by  either  crewmember  during 
the  emergency  period. 
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100  1000  10000 

Altimeters  and  flight  instruments  thirty 
eleven? 

approach  brief? 
ah,  don’t  do  this  to  me. 

OK,  one 

four  zero  heading  and  one  ninety  on  the 
speed,  USAir  from  twenty  seven 

did  you  say  two  eight  left  for  USAir 
four  twenty  seven? 

two  eight  right,  thank  you. 

two  eight  right. 

seven  for  six. 

boy,  they  always  slow  you  up  so  bad 
here. 

we're  looking  for  the  traffic,  turning  to 
one  zero  zero,  USAir  four  twenty  seven. 

sheez. 

whoa, 
hang  on. 
hang  on. 
hang  on. 
hang  on. 
what  the  hell  is  this? 

oh  God.. 

oh  God. 

four  twenty  seven  emergency. 

pull 
pull 

Figure  30.  Amplitude  measures  for  the  USAir  flight  427  captain’s  speech. 
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1.16.8.1  Independent  Specialists’  Review  of  Pilots’  Speech,  Breathing,  and 
Other  Sounds — USAir  Fiight  427 

The  laboratory  speech  analysis  results  and  CVR  tape  and  transcript  from  USAir 
flight  427  were  provided  to  three  independent  specialists  from  the  Interstate  Aviation 
Committee,  Moscow,  Russia;^''*  the  U.S.  Naval  Aerospace  Medical  Research  Laboratory, 
Pensacola,  Florida;^'^  and  NASA’s  Ames  Research  Center,  Moffett  Field,  Califomia.^'^ 
Their  areas  of  specialization  were  general  speech  analysis  (focusing  on  issues  of 
psychological  stress  and  physical  effort),  breathing  physiology,^*’  and  communication 
information,  respectively. 

The  specialists  agreed  that  the  USAir  flight  427  CVR  recorded  no  speech  patterns 
by  the  pilots  or  other  sounds  to  indicate  that  either  pilot  was  physiologically  impaired  or 
incapacitated;  rather,  the  specialists  stated  that  both  pilots  sounded  alert  and  responsive 
throughout  the  flight,  including  the  upset  and  accident  sequence.  The  specialists  agreed 
that  the  first  indication  of  the  upset  event  on  the  CVR  recording  occurred  about  1902:57, 
just  as  the  first  officer  finished  stating,  “oh,  ya,  I  see  zuh  Jetstream.”  Within  1  second,  the 
CVR  recorded  a  sound  similar  to  three  thumps  (see  section  1.16.7.1),  “sheeez”  from  the 
captain,  and  “zuh”  from  the  first  officer.  The  specialists  stated  that  the  speech  patterns  of 
the  pilots  indicated  that  they  were  surprised  by  the  initial  upset,  but  the  specialists  agreed 
that  the  pilots  responded  promptly  to  the  situation  and  were  attempting  to  control  the 
airplane  and  identify  the  problem.  None  of  the  specialists  were  able  to  determine  if  the 
pilots  were  operating  the  control  wheel,  the  rudder,  or  both  in  their  efforts  to  control  the 
airplane. 

To  ensure  that  all  the  straining,  grunting,  and  other  sounds  recorded  by  the  CVR 
were  thoroughly  and  accurately  documented,’**  the  Safety  Board  and  the  independent 
speech  experts  from  Moscow’s  Interstate  Aviation  Committee  and  the  U.S.  Naval 


This  specialist  is  the  Chief  of  the  Acoustical  Laboratory  at  the  Interstate  Aviation  Committee.  He  has 
a  medical  degree  and  graduate  level  training  in  psychology.  He  has  participated  in  more  than  250  aviation 
accident  investigations  and  specializes  in  medical  and  psychological  aspects,  especially  the  psychological 
analysis  of  speech. 

This  specialist  is  a  Research  Physiologist  in  the  Aviation  and  Operational  Medicine  Department  of 
the  U.S.  Naval  Aerospace  Medical  Research  Laboratory.  He  has  a  doctorate  degree  in  exercise  physiology, 
and  his  research  includes  work  on  the  effects  of  physical  fitness  on  normal  load  factor  tolerance  and  the 
development  of  anthropometric  standards  for  naval  aviators. 

This  specialist  is  a  Research  Psychologist  at  the  NASA’s  Ames  Research  Center.  She  has  a  doctorate 
degree  in  behavioral  sciences,  and  her  research  addresses  aerospace  human  factors,  focusing  on  crew 
communication,  coordination,  and  performance  issues. 

Breathing  sounds  are  normally  not  audible  on  the  CAM  channel,  which  is  recorded  by  a  microphone 
in  the  overhead  panel  above  the  pilots  (and  used  for  most  CVR  transcripts).  However,  breathing  sounds  are 
often  audible  on  the  “hot  microphone”  channels  recorded  from  boom  microphones  attached  to  the  headset  of 
each  pilot  and  positioned  directly  in  front  of  each  pilot’s  mouth.  The  breathing  information  in  this 
investigation  was  recorded  on  these  hot  microphone  channels. 

The  CVR  transcript  indicates  that  the  captain  inhaled  and  exhaled  quickly  at  1902:58.7  and  that  the 
first  officer  was  grunting  at  1903.01.6.  Several  other  instances  of  such  sounds  on  the  CVR  are  not  noted  in 
the  transcript.  The  Safety  Board  does  not  generally  document  every  such  sound  when  preparing  official 
transcripts  of  CVR  recordings. 
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Aerospace  Medical  Research  Laboratory  reexamined  the  sounds  recorded  by  the  CVR 
between  1902:57.6  and  1903:23.  Both  experts  noted  additional  sounds  recorded  on  the 
first  officer’s  hot  microphone  channel  that  could  indicate  high  physical  loads.  These 
sounds  and  their  duration  were  documented  by  Safety  Board  investigators  as  follows: 

•  “zuh”  from  1902:57.6  to  1902:57.8, 

•  a  rapid  inhale  from  1902:59.7  to  1902:59.9, 

•  a  soft  grunt  from  1903:00.3  to  1903:00.5, 

•  a  louder  grunt  from  1903:01.5  to  1903:01.6, 

•  a  loud  exhale  from  1903:01.8  to  1903:02.1,  and 

•  “oh  [expletive]”  from  1903:04.6  to  1903:05.1. 

No  other  inhaling,  exhaling,  or  vocalizing  sounds  were  detected  during  this  time 

period. 

1 .1 6.8.1 .1  Sumnfiary  of  Observations  of  Interstate  Aviation  Committee 
Specialist 

The  specialist  from  Moscow’s  Interstate  Aviation  Committee  reviewed  the  pilots’ 
speech  communication  and  other  noise  evidence  recorded  by  the  CVR  to  evaluate  the 
pilots’  responses,  actions,  and  psychological  state  during  the  emergency.  He  stated  that,  at 
1902:57.5,  both  pilots  exhibited  symptoms  of  sudden  surprise  that  were  “characteristic  of 
a  human  response  to  sudden  motion  or  to  a  physical  disturbance.” 

The  specialist  observed  that  both  pilots  showed  symptoms  of  psychological  stress 
(increased  amplitude  and  fundamental  frequency  of  speech,  increased  frequency  of 
breathing,  and  reduced  information  within  a  statement)  beginning  almost  immediately 
after  the  initial  upset  and  that  these  symptoms  increased  throughout  the  accident  sequence. 
However,  the  specialist  believed  that  the  increased  psychological  stress  did  not  necessarily 
interfere  with  the  pilots’  ability  to  respond  to  the  emergency  situation.  The  specialist’s 
report  stated  that  stress  can  be  viewed  as  having  the  following  three  increasing  stages, 
which  reflect  typical  changes  in  performance: 

Psychological  stress,  at  low  levels,  can  improve  a  person’s  performance  by 

providing  a  constructive  mobilization  of  attention  and  resources  (first 

stage).  As  the  person’s  stress  increases,  the  performance  often  displays 


One  participant  in  this  examination  thought  that  the  louder  grunting  and  loud  exhale  (the  fourth  and 
fifth  sounds  on  the  list)  were  part  of  the  same  straining  effort  but  agreed  with  the  other  participants  to 
provide  separate  timings  for  both  sounds. 

As  a  guideline,  the  specialist  from  the  Interstate  Aviation  Committee  indicated  that  stage  1  speech  is 
characterized  by  an  intra-individual  increase  in  fundamental  frequency  of  about  30  percent  compared  with 
that  individual’s  speech  in  a  relaxed  condition,  stage  2  speech  is  characterized  by  an  increase  in  fundamental 
frequency  of  50  to  150  percent,  and  stage  3  speech  is  characterized  by  an  increase  of  100  to  200  percent. 
These  guidelines  are  advisory  and  considered  with  other  speech  factors  in  characterizing  the  speaker’s  level 
of  stress. 
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hasty  or  premature  actions  [such  as  the  omission  of  words  or  checklist 
items].  However,  they  can  still  accomplish  their  task  (second  stage).  It  is 
only  at  the  highest  levels  of  stress  (third  stage,  or  “panic”),  that  the  person 
can  not  think  or  perform  clearly. 

The  specialist  further  observed  that,  although  the  captain’s  level  of  psychological 
or  emotional  stress  was  increasing  during  the  emergency,  he  was  still  capable  of  adequate 
responses;  the  captain’s  attempts  to  evaluate  the  situation  were  reflected  in  his  statements 
“hang  on”  and  “what  the  hell  is  this?”  (about  1903:05  and  1903:08,  respectively). 
According  to  the  specialist,  although  the  captain’s  response  to  an  ATC  transmission  at 
1903:15  was  “incomplete  and  it  is  obvious  that  the  situation  was  unclear  for  him,”  the 
attempt  to  respond  demonstrated  that  the  captain  was  capable  of  appropriate  responses. 

The  specialist’s  review  of  the  USAir  flight  427  captain’s  fundamental  frequencies 
indicated  that  when  he  spoke  the  phrase  “four  twenty  seven”  during  the  emergency  (about 
1903:15),  the  fundamental  frequency  was  47  percent  higher  than  the  average  fundamental 
frequency  when  that  phrase  was  spoken  during  routine  flight  operations.  Additionally, 
although  this  communication  was  incomplete  (“four  twenty  seven  emergency”),  it  was 
appropriate  for  the  situation.  The  specialist  believed  that  the  captain  was  operating  at  the 
second  stage  of  psychological  stress  at  that  time  because  his  speech  displayed 
characteristics  of  a  significant  level  of  stress  but  did  not  indicate  that  he  had  reached  a 
level  of  panic  (the  third  stage). 

The  specialist  stated  that  neither  of  the  USAir  flight  427  pilots  exhibited  the  third 
stage  of  psychological  stress  until  1903:17.4  (about  5  seconds  before  ground  impact).  The 
specialist  reported  that  the  captain  then  appeared  to  enter  the  highest  stage  of  emotional 
stress  because  he  issued  inadequate  commands  between  1903:18.1  and  1903:19.7 
(“pull... pull... pull”)  and  was  unable  to  “act  and  react  in  accordance  to  the  situation.”  The 
specialist  also  noted  that  the  first  officer  “demonstrated  high  levels  of  psychological  stress 
before  the  impact,  reflected  by  the  speech  degrading  into  short  exclamations  and 
expletives.” 

In  his  analysis  of  the  pilots’  physical  responses,  the  specialist  reported  that  the  first 
officer  exhibited  signs  of  high  physical  effort  (coinciding  with  signs  of  increased 
psychological  stress).  According  to  the  specialist,  the  first  officer  exhibited  speech 
disruptions,  such  as  grunts  and  forced  exhalations  beginning  at  1902:59.7  (when  he  was 
likely  to  have  been  actively  controlling  the  airplane)  and  continuing  for  several  seconds. 
The  specialist  stated  that: 

...a  person  making  a  great  physical  effort  develops  a  musculo-skeletal 
“fixation”  (of  the  chest),  which  leads  to  deterioration  of  the  normal 
expansion  and  ventilation  of  the  lungs  (inhaling  and  exhaling).  These 
changes  are  manifested  during  speech.  Sounds  such  as  grunting  and  strain 
appear  in  speech  as  the  person  tries  to  minimize  the  outflow  of  air.  Inhaling 
and  exhaling  become  forced  and  rapid.” 

The  specialist  further  stated  that  normal  use  of  the  cockpit  controls  should  not 
produce  these  types  of  sounds.  He  said  that  the  sounds  emitted  by  the  first  officer  during 
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the  upset  sequence  indicated  that  “[he]  was  struggling  unusually  hard... [as]  if  he  was 
experiencing  unusual  resistance  in  the  use  of  a  control.” 

The  specialist  noted  that,  although  the  first  officer  displayed  signs  of  significant 
physical  effort  almost  immediately  after  the  upset  event,  he  did  not  display  those  signs 
throughout  the  entire  accident  sequence.  At  1903:04.6,  when  the  first  officer  stated  “oh 
[expletive],”  no  evidence  of  grunting,  straining,  or  forced  exhalation  was  recorded. 
However,  at  1903:18.5,  the  first  officer’s  statement  of  “oh  [expletive]”  was  accompanied 
by  forced  exhalation,  exhibiting  evidence  of  high  physical  exertion.  The  specialist  stated 
that  the  first  officer’s  “unconscious  pressing  of  ATC/intercom  switch  suggests  that  he 
could  be  trying  to  position  his  hands  on  the  control  wheel  during  the  high  pulling 
forces.”22' 


According  to  the  specialist,  during  the  last  5  seconds  of  the  flight,  the  captain 
began  to  exhibit  symptoms  of  increased  physical  effort,  as  evidenced  by  short,  forced 
inhalations  after  each  “pull”  command.  On  the  basis  of  his  observations,  the  specialist 
from  the  Interstate  Aviation  Committee  developed  the  following  conclusions: 

•  The  accident  sequence  was  completely  unexpected  by  the  crew.  It  caused  their 
orientation  response  of  the  “What  is  that?!”  type. 

•  The  accident  sequence  was  completely  unclear  for  the  crew. 

•  From  the  beginning  of  the  accident  sequence  until  1903:18.1  the  captain  did 
not  apply  high  physical  loads  to  the  controls  and,  most  likely,  did  not 
participate  in  the  control. 

•  The  first  officer  applied  physical  loads  and  controlled  the  airplane.  The  loads 
were  high,  probably  maximum,  but  varied  during  the  upset  period. 

•  Both  crew  members  experienced  high  psychological  stress.  At  the  last 
moments  (beginning  at  1903:17.4),  stress  increased  and  became  a  panic 
(stage  3). 

1 .1 6.8.1 .1 .1  Interstate  Aviation  Committee  Specialist’s  Guideiines  Appiied 
to  United  Flight  585  CVR  Information 

The  Safety  Board  applied  the  specialist’s  guidelines  and  criteria  to  the  speech  and 
other  sounds  recorded  by  the  United  flight  585  CVR.  In  this  case,  when  the  captain  spoke 
the  word  “flaps”  during  the  accident  sequence  (at  0943:33.5),^^^  his  speech  fundamental 
frequency  was  77  percent  higher  than  when  he  spoke  the  same  word  during  routine  flight 
operations.  In  addition,  the  captain’s  statement  “fifteen  flaps”  (at  0943:33.5)  signified  a 


Evidence  from  the  ATC  transcript  and  the  CVR  indicated  that  the  first  officer’s  ATC/intercom  switch 
was  intermittently  activated  from  1903:09:4  (shortly  after  CVR  began  to  record  a  vibrating  sound  similar  to 
an  airplane  stickshaker  at  1903:08.01)  to  the  end  of  the  CVR  recording  at  1903:22.8.  In  addition  to  the 
intercom  switches  located  on  the  radio  selector  panels  outboard  of  each  pilot’s  knees  in  the  cockpit 
(discussed  in  section  1.16.7.2),  an  intercom  switch  is  also  located  on  the  forward  side  of  the  control  wheel 
(away  from  the  pilots). 

All  times  in  this  section  are  mountain  standard  time,  based  on  a  24-hour  clock. 
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go-around  decision  but  occurred  without  the  captain  first  stating  “go-around  thrust,”  as 
specified  in  the  procedures  section  of  the  company  flight  manual  at  the  time  of  the 
accident.  According  to  the  specialist’s  guidelines,  the  captain’s  responses  (high 
fundamental  frequency  value  and  omission  of  a  standard  procedure  item  while 
communicating  and  responding  appropriately  to  the  situation)  indicated  that  he  was  likely 
operating  at  the  second  stage  of  stress  at  0943:33.5.  He  had  not  reached  panic  but  was 
displaying  characteristics  of  a  high  level  of  stress  within  about  IVi  seconds  of  the  onset  of 
the  emergency  period.  The  Safety  Board’s  examination  of  the  remaining  8  seconds  of 
CVR  information  indicated  that  the  pilots  likely  reached  the  third  stage  of  stress— panic- 
before  the  airplane  crashed. 

1.16.8.1.2  Summary  of  Observations  of  U.S.  Naval  Aerospace  Medical 
Research  Laboratory  Specialist 

The  specialist  from  the  U.S.  Naval  Aerospace  Medical  Research  Laboratory 
reviewed  the  USAir  flight  427  CVR  to  provide  observations  on  pilot  breathing  and 
muscular  exertion.  The  specialist  stated  that  both  pilots  appeared  “conscious  and  fully 
aware  of  the  emergency  nature  of  the  situation”  and  that  “neither  seemed  impaired  or 
incapacitated  [according  to]  the  sounds  heard  on  the  tape.” 

With  regard  to  the  captain,  the  specialist  noted  that  “after  the  onset  of  the 
emergency  period,  the  rate  of  breathing  of  the  [captain]  increased... there  was  an  initial, 
large  exhalation  with  the  utterance  ‘sheeez’  in  response  to  the  first  sudden,  unusual 
movement  of  the  aircraft  at  the  start  of  the  emergency  sequence.  That  was  followed 
shortly  by  a  deep,  rapid  inhalation“^  before  the  word  ‘whoa’  was  heard  from  the  captain, 
almost  as  if  he  was  startled  by  the  continued  departure  of  the  aircraft  from  normal  flight. 
The  breathing  response  of  the  captain  after  the  onset  of  the  emergency  appears  to  have 
been  a  normal  sympathetic  nervous  system  response  that  would  include  increased  heart 
rate,  breathing  rate,  body  temperature,  and  blood  pressure,  all  commonly  observed  in 
emergency  situations.” 

The  specialist  stated  that,  almost  immediately  after  the  initial  upset,  the  CVR 
recorded  two  rapid  grunting  exhalations  on  the  first  officer’s  channel,  which  the  specialist 
attributed  to  the  first  officer’s  muscular  exertion  to  control  the  airplane  during  the  accident 
sequence.  The  specialist  also  stated  that  the  first  grunting  sound  was  soft,  whereas  the 
second  was  louder  and  more  forceful,  representing  the  use  of  increased  muscular  force. 
Other  than  the  first  officer’s  deep  rapid  breathing,  no  additional  audible  (nonverbal)  noises 
were  recorded  on  the  first  officer’s  channel  during  the  remainder  of  the  recording.  The 
specialist  stated  that,  although  the  CVR  did  not  record  similar  indications  of  muscular 
exertion/strain  on  the  captain’s  channel,  “that  is  not  to  say  that  the  [captain]  was  not  on  the 
controls,  but  only  that  he  did  not  appear  to  be  exerting  increased  muscular  force.... 


The  USAir  flight  427  captain’s  breathing  response  is  noted  in  the  CVR  transcript  at  1902:59.1  as  a 
“sound  similar  to  person  inhalin^exhaling  quickly  one  time,” 

224  specialist  stated  that  the  captain  (who  had  recently  returned  to  flying  duties  after  back  surgery) 
may  have  been  reluctant  to  exert  excessive  muscular  force  with  his  upper  body  because  of  the  surgical 
repair. 
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The  specialist  stated  that  “the  physical  act  of  manipulating  the  controls  of  modem  aircraft 
under  normal  conditions  does  not  usually  require  excessive  muscular  force... during 
emergency  situations,  increased  muscular  force  may  be  needed. . . .” 

1.16.8.1.3  Summary  of  Observations  of  NASA’s  Ames  Research  Center 
Specialist 

The  specialist  from  NASA’s  Ames  Research  Center  reviewed  the  USAir  flight  427 
CVR,  focusing  on  the  flight  crew’s  task-related  (routine  and  emergency),  procedural  (ATC 
communications,  checklists,  and  PA  announcements),  and  nontask-related  (interpersonal 
interactions)  speech  communications.  She  stated  that  the  pilots’  speech  communications 
during  the  routine  portion  of  the  flight  appeared  to  be  complete,  cooperative,  and 
responsive  and  that  the  interactions  between  crewmembers  were  casual  and  friendly.  She 
reported  that  crew  coordination  was  thorough  and  that  neither  pilot  appeared  reluctant  to 
seek  or  incorporate  information  from  each  other  or  ATC.  The  specialist  noted  that  all 
coordination  issues  and  questions  had  been  resolved  and  that  all  appropriate  procedural 
communications  appeared  to  have  been  accomplished  (checklists  and  PA  announcements) 
before  the  initial  upset  occurred. 

The  specialist  indicated  that  an  evaluation  of  the  speech  communications  recorded 
during  the  emergency  portion  of  the  flight  was  made  difficult  because  flight  crew  speech 
in  the  final  25  seconds  of  the  CVR  recording  was  minimal  and  often  fragmented.  The 
specialist  stated  that  the  comments  made  by  the  first  officer  throughout  the  accident 
sequence  did  not  contain  much  information.  She  reported  that  the  best  source  of  verbal 
information  during  the  accident  sequence  was  contained  in  the  captain’s  statements 
between  about  1902:57  and  about  1903:10.  The  specialist  stated  that,  although  the 
captain’s  language  was  ambiguous  during  this  period,  it  indicated  that  he  recognized  that  a 
problem  existed  but  that  he  had  not  yet  identified  the  source  or  nature  of  the  problem. 

1.17  Operational  and  Management  Information 

1.17.1  USAir 

At  the  time  of  the  accident,  USAir  employed  approximately  46,000  people  and 
operated  a  fleet  of  443  aircraft,  including  234  Boeing  737s.^^^  USAir  maintained  major 
hub  operations  in  Pittsburgh  and  Charlotte  and  smaller  hub  operations  in  Philadelphia; 
Indianapolis;  and  Baltimore,  Maryland.  USAir’s  heavy  maintenance,  structural  repairs, 
and  overhauls  were  accomplished  in  Pittsburgh;  Charlotte;  and  Winston-Salem,  North 
Carolina. 

In  the  6  years  preceding  the  accident,  USAir  had  grown  as  the  result  of  several 
mergers.  The  largest  mergers  occurred  in  1988,  when  USAir  acquired  PSA,  and  in  1989, 
when  USAir  merged  with  Piedmont  Airlines.  According  to  USAir  personnel. 


Records  indicate  that  the  234  Boeing  737  airplanes  operated  by  USAir  included  79  737-200  series 
models,  101  737-300  series  models,  and  54  737-400  series  models. 
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standardization  of  the  different  pilot  groups  that  resulted  from  the  mergers  was 
accomplished  through  a  process  described  as  “mirror-imaging.”  Specifically,  USAir 
developed  a  team  of  check  airmen  from  USAir,  PSA,  and  Piedmont  Airlines  to  establish 
standardized  procedures  for  the  merged  aircraft  fleet  based  on  the  procedures  used  by 
USAir  at  the  time.  Checklists,  flight  operations  manuals,  and  pilot  handbooks  were 
rewritten,  and  flight  and  simulator  training  sessions  were  revised  to  implement  the 
standardized  procedures.  A  review  of  USAir  staffing  assignments  revealed  that 
management  and  training  positions  were  staffed  by  personnel  with  backgrounds  from 
USAir,  PSA,  and  Piedmont.  USAir  management  and  training  personnel  reported  that  they 
believed  that  the  merged  airlines’  procedures,  personnel,  and  aircraft  had  been 
successfully  integrated. 

At  the  time  of  the  accident,  USAir  had  a  full-time  Quality  Assurance/Flight  Safety 
Department  that  was  responsible  for  identifying,  communicating,  and  resolving  flight 
safety-related  issues.  The  Director  of  Flight  Safety  reported  to  the  Vice  President  of  Flight 
Operations.  The  Quality  Assurance/Flight  Safety  Department  interacted  with  the  FAA, 
AT. PA,  USAir  management,  USAir  training  personnel,  and  line  pilots  to  develop  and 
disseminate  safety-related  information  to  flight  crews.  Safety  information  was 
communicated  to  employees  via  electronic  mail;  bulletin  boards;  attachments  to  flight 
paperwork;  printed  notices  distributed  to  company  mailboxes;  periodic  “Flight  Crew 
View”  publications;  and  USAir’s  Flight  Training  and  Standards  Department  during 
simulator,  line  check,  CRM,  and  LOPT  training  sessions. 

Because  USAir  was  a  military  contract  carrier,  the  Department  of  Defense 
completed  a  survey  in  June  1994  that  rated  the  airline’s  capabilities.  USAir  received 
“excellent”  to  “above  average”  ratings  in  all  areas  of  flight  crew  operations,  training,  and 
safety. 

1.17.2  USAir  Flight  Training 

USAir’s  Flight  Training  and  Standards  Department  was  responsible  for  ensuring 
the  continuing  competency  of  the  pilots,  check  pilots,  and  instructors  in  each  of  the 
aircraft  operated  by  the  company.  At  the  time  of  the  accident,  six  flight  training  managers 
were  responsible  for  training  in  the  following  aircraft: 

•  Boeing  727, 757,  and  767; 

•  Boeing  737-300  and  -400; 

•  Boeing  737-200; 

•  Douglas  DC-9  and  McDonnell  Douglas  MD-80; 

•  Fokker  F.  100 ;  and 

•  Fokker  F.28. 

The  training  staff  for  the  737-300  and-400  airplanes  consisted  of  two  senior  check 
airmen,  6  check  pilot  designees,  and  47  full-time  check  pilots.  According  to  the  Director 
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of  Flight  Training  and  Standards,  USAir  flight  training  staff  performed  all  training  and 
flight  check  functions,  including  initial  simulator  training,  initial  operating  experience 
(lOE),  proficiency  checks,  requalifications,  line  checks,  CRM,  LOFT,  and  special  airport 
qualification  training.  Additionally,  the  Director  of  Flight  Training  and  Standards  stated 
that  the  FAA,  ALFA,  and  USAir  flight  training  personnel  met  regularly  to  discuss 
standardization  matters,  such  as  syllabi,  procedures,  training  techniques,  grading  criteria, 
and  trend  analyses. 

1.18  Additional  Information 

1.18.1  Overall  Accident  Record  and  History  of  the  737 

According  to  Boeing,  737  series  airplanes  have  flown  more  than  92  million  hours 
since  entering  service  in  December  1967.  During  its  investigation  of  the  USAir  flight  427 
accident,  the  Safety  Board  reviewed  the  overall  accident  history  record  of  the  Boeing  737 
airplane  and  compared  this  record  with  other  generally  comparable  airplane  types.  The 
Safety  Board  examined  worldwide  aviation  accident  and  departure  data  provided  by 
Airclaims  Limited  of  London,  England.^^^  These  data  indicated  that  737  series  airplanes 
were  involved  in  43  total  loss  accidents^^’  between  January  1988  and  December  1997, 
which  corresponds  to  0.99  total  loss  accidents  per  1  million  departures.^^*  Table  7  shows 
total  loss  accident  data  for  several  airplane  types  arranged  in  order  of  least  to  most  number 
of  total  loss  accidents  per  1  million  departures. 


Table  7.  Number  of  worldwide  total  loss  accidents  and  total  loss  accidents  per  1  million 
departures  for  selected  aircraft  types,  1988-97. 


Airplane  type 

Total  number 
of  loss  accidents 

Total  loss  accidents 
per  1  million  departures 

Boeing  757 

4 

0.62 

Douglas  DC-9/McDonnell 

Douglas  MD-80 

27 

0.86 

Airbus  A319,  A320,  and  A321 

5 

0.95 

Boeing  737 

43 

0.99 

Boeing  727 

23 

1.19 

Fokker  F.28,  R70,  and  R100 

15 

2.23 

Airclaims  Limited  is  an  aviation  consulting  firm  that  collects  data,  in  part,  for  the  aviation  insurance 
industry.  The  Airclaims  Limited  database  is  recognized  by  the  aviation  industry  as  a  definitive  source  for 
worldwide  aviation  accident  information. 

Airclaims  Limited  defines  a  total  loss  as  an  aircraft  that  has  been  destroyed  or  for  which  the 
estimated  repair  costs  rendered  the  aircraft  a  total  loss  under  the  terms  of  the  insurance  contract.  (Airclaims 
Limited  notes  that  some  aircraft  that  became  total  losses  have  been  repaired  and  returned  to  service.)  Any 
total  losses  that  Airclaims  listed  as  the  result  of  a  deliberate  violent  act  were  eliminated  from  these  data. 

Airclaims  Limited.  1998.  Airliner  Loss  Rates.  Heathrow  Airport,  England. 
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1.18.1.1  History  of  737  Potential  Rudder  System  and/or  PCU-Related 
Anomalies/Events 

The  following  list  of  selected  737  yaw/roll  events  describes  identified  rudder- 
related  anomalies  that  were  reported  before  the  USAir  flight  427  accident.  (Yaw/roll 
events  reported  after  the  USAir  flight  427  accident  are  discussed  later  in  this  section  and 
are  listed  in  appendix  E.)  Some  of  the  anomalies  summarized  in  this  section  were 
previously  discussed  in  the  Safety  Board’s  final  report  on  the  737  accident  at  Colorado 
Springs,  and  others  were  reported  to  Boeing  through  various  means  (such  as  reports  from 
AAIB  and  the  civil  airworthiness  authority  of  New  Zealand).  As  a  result,  the  extent  to 
which  these  events  were  documented  and  the  amount  of  available  data  regarding  these 
events  varied  widely. 

•  On  July  24,  1974,  the  flight  crew  of  a  737  reported  that  a  rudder  moved  "full 
right"  upon  touchdown.  The  investigation  revealed  that  the  primary  and 
secondary  slides  were  stuck  together  by  a  shotpeen  ball  lodged  in  the  servo 
valve. 

•  On  October  30,  1975,  during  a  main  rudder  PCU  inspection,  shotpeen  balls 
were  found  in  a  servo  valve  that  had  undergone  chrome  plating. 

•  On  August  26,  1977,  the  flight  crew  of  a  737  reported  that,  during  taxi,  the 
right  rudder  pedals  moved  in  "half  way"  and  then  jammed.  This  event 
happened  three  times  and  was  corrected  each  time  by  cycling  the  rudder  with 
the  standby  rudder  system.  Further  examination  indicated  that  the  main  rudder 
system  was  contaminated  by  metal  particles. 

•  On  August  31,  1982,  a  737  reported  that  the  rudder  "locked  up"  on  approach 
and  that  the  flight  crew  initiated  a  go-around  and  activated  the  standby  rudder 
system.  The  subsequent  landing  was  uneventful.  The  examination  of  the  PCU 
revealed  internal  contamination  and  worn  seals,  which  resulted  in  the  PCU 
having  a  limited  capability  to  generate  enough  force  to  move  the  rudder. 

•  On  November  8,  1990,  during  an  overhaul,  a  main  rudder  PCU  was  found  to 
have  internal  corrosion.  The  primary  slide  was  stuck  to  the  secondary  slide  at 
the  neutral  position  as  a  result  of  the  corrosion.  No  malfunctions  were  reported 
before  disassembly. 

•  On  January  4,  1993,  the  flight  crew  of  a  United  Airlines  737-300,  N309UA, 
reported  a  “hydraulic  block/binding”  during  the  flight  control  check.  The  main 
rudder  PCU  was  removed  from  the  airplane  and  shipped  to  Parker  for 
examination.  When  tested  in  its  “as  received”  condition,  the  PCU  exhibited 
reduced  rates,  complete  stalls,  and  reversals  while  being  commanded  in  the 
retract  direction  (right  rudder).  Further  examination  at  the  Parker  facility 
revealed  that  the  servo  valve  retaining  nut  was  loose;  when  the  retaining  nut 
was  tightened  properly  (to  170  inch-pounds),  investigators  were  unable  to 
duplicate  the  anomalies  that  were  observed  during  the  previous  testing.  As  a 
result  of  this  investigation,  Boeing  and  Parker  modified  the  spring  guide 
(which  locks  the  retaining  nut  in  place)  to  provide  better  engagement  with  and 
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retention  of  the  nut.  The  companies  also  devised  an  additional  test  procedure  to 
stroke  the  secondary  slide  within  the  internal  limits  of  the  servo  valve.  This  test 
procedure  was  added  to  Parker’s  acceptance  test  procedure  and  Boeing’s 
Overhaul  Manual. 

•  On  April  16,  1993,  the  flight  crewmembers  of  an  Air  New  Zealand  737-200 
reported  that  they  were  descending  from  FL  350  to  FL  330  (because  of 
turbulence  encountered  at  the  higher  altitude)  when  they  experienced  a  series 
of  uncommanded  rudder  inputs  (with  rudder  pedal  feedback)  that  continued 
(randomly  right  and  left)  throughout  the  remainder  of  the  flight.  The  pilots 
reported  that,  during  landing,  a  “large”  left  rudder  offset  was  experienced.  Both 
pilots  stated  that  the  rudder  was  stiffer  than  normal  throughout  the  incident 
flight.  Postincident  testing  revealed  that  the  yaw  damper  coupler  was  capable 
of  normal  operation  (although  the  rate  gyro  tested  “out  of  limits”)  and  that  the 
standby  and  main  rudder  PCUs  operated  normally  except  when  the  standby 
PCU  was  tested  at  cooler  temperatures^^  with  3,000  psi  hydraulic  pressure. 
Under  those  test  conditions,  the  input  arm  required  up  to  4.5  pounds  of  force 
before  it  moved;  the  input  arm  normally  moves  with  about  0.5  pounds  of  force. 
Evidence  of  corrosion  was  found  on  the  outer  diameter  of  the  bypass  valve 
sleeve,  and  slight  galling  was  noted  on  the  input  shaft  and  bearing. 

•  On  August  31,  1994,  a  British  Airways  737-200,  G-BGJI,  experienced  a  full 
left  rudder  deflection  and  subsequent  rudder  jam  when  the  standby  rudder 
system  was  selected  during  ground  operations.  According  to  the  United 
Kingdom  civil  airworthiness  authority,  when  the  standby  rudder  system  was 
selected,  no  rudder  movement  was  possible  through  the  rudder  pedals. 
However,  when  the  standby  rudder  system  was  deactivated  and  rudder  system 
operation  was  transferred  to  hydraulic  systems  A  and/or  B,  the  rudder  jam  was 
eliminated,  and  the  rudder  returned  to  neutral.  The  standby  rudder  actuator  was 
removed  and  replaced,  and  the  rudder  subsequently  functioned  normally  on 
hydraulic  systems  A  and  B  and  the  standby  hydraulic  system.  A  partial 
teardown  of  the  standby  rudder  actuator  revealed  that  the  servo  valve  had 
seized;  examination  revealed  corrosion  and  water  in  the  unit  and  corrosion  in 
the  bypass  valve,  input  shaft,  and  input  shaft  bearing. 

In  January  1999,  Parker  notified  the  Safety  Board  that  a  recent  search  of  its  files 
produced  three  additional  reports  of  anomalous  Boeing  737  main  rudder  PCU  operation. 
Two  reports  were  from  1982,  and  one  was  from  1984. 

The  first  report,  dated  October  4,  1982,  indicated  that  Parker  had  examined  a  main 
rudder  PCU  at  Boeing’s  request  “to  determine  the  cause  for  rudder  lockup  during 
flight.”^^®  No  date  for  the  rudder  lockup  event  was  specified  in  the  report.  Fluid  samples 
removed  from  the  unit  were  found  to  be  contaminated,  but  the  nature  of  the  contamination 


Since  the  time  that  it  was  notified  of  this  event,  the  Safety  Board  has  made  several  requests  (first  in 
May  1993  and  most  recently  in  October  1998)  for  additional  information  regarding  the  temperatures  used 
during  these  tests.  To  date,  officials  at  Air  New  Zealand,  the  New  Zealand  civil  airworthiness  authority,  and 
Boeing  have  been  unable  to  provide  the  requested  information. 
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was  not  described  in  the  report.  The  PCU  passed  Parker’s  acceptance  test  procedure  at 
room  temperature;  however,  when  it  was  cooled  to  -65°  F,  the  PCU  failed  the  linkage 
breakout  friction  test  (which  measures  the  amount  of  force  needed  to  move  the  input  arm) 
in  the  extend  direction  and  the  yaw  damper  system  test  (which  measures  consistency  of 
yaw  damper  response).  According  to  the  report,  a  new-production  PCU  also  failed  these 
tests  at  -65°  F.  The  incident  PCU  was  disassembled  after  the  testing,  and  no  discrepancies 
were  noted. 

Parker  summarized  the  results  of  its  examination  as  follows: 

...no  determination  could  be  made  as  to  the  cause  for  the  rudder  lockup. 

Both  units,  during  the  subtemperature  tests,  exhibited  high  friction  and 
reduced  reactions  to  electrical  input  signals.  These  high  frictions  and 
reactions  exceeded  the  allowable  specifications  [sic];  however,  it  is 
Parker[]’s  opinion  that  this  would  be  expected  at  the  low  temperatures. 

This  friction  would  be  the  result  of  changes  in  the  materials,  which  would 
affect  the  close  tolerance  fit  of  mating  parts,  ie:  linkages,  bearings,  lap  fits 
of  valve  assemblies,  etc . 

The  second  report,  dated  October  8,  1982,  also  stated  that  a  main  rudder  PCU  was 
examined  “to  determine  the  cause  for  rudder  lockup  during  flight.”  The  report  did  not 
specify  a  date  of  the  rudder  lockup  event.  The  PCU  passed  all  of  Parker’s  acceptance  tests 
with  the  exception  of  the  yaw  damper  system  test  and  the  yaw  damper  engage  test  (which 
tests  the  yaw  damper’s  response  when  it  is  switched  on).  Disassembly  of  the  PCU 
indicated  excessive  wear  on  the  yaw  damper’s  walking  beam  assembly.  When  the  servo 
valve  was  removed  from  the  PCU  and  the  primary  slide  was  fully  retracted  into  the 
secondary  slide,  the  primary  slide  jammed  against  the  secondary  slide.  However,  when  the 
servo  valve  was  reinstalled  on  the  PCU,  the  primary  slide  could  not  travel  as  far  in  the 
secondary  slide  as  it  had  when  it  was  removed  from  the  PCU;  thus,  the  primary  slide  did 
not  jam  in  the  secondary  slide.  The  report  indicated  that  the  servo  valve  was  removed  and 
tested  again  but  that  “no  evidence  of  binding,  jamming,  or  lockup  could  be  verified.” 

Parker  summarized  the  results  of  its  examination  as  follows: 

...no  determination  could  be  made  as  to  the  cause  for  a  rudder  lockup.  The 
test  findings  for  the  phase  Lag  and  Yaw  Damper  Engage  tests  were 
determined  to  have  been  caused  from  the  Transfer  Valve  being  off  null 
position.  It  was  determined  that  the  Servo  Slide  does  not  have  enough 
travel  by  design  to  allow  the  Primary  Slide  to  bottom  into  the  Secondary 
Slide  and  jam.  Parker[]’s  conclusion  to  the  investigation  is  that  none  of  the 
noted  findings  could  have  caused  the  rudder  lockup. 

The  third  report,  dated  May  11,  1984,  describes  a  January  25,  1984,  examination 
of  a  main  rudder  PCU  that  experienced  an  “intermittent  kick  and  hardover  condition.” 
According  to  the  report,  Boeing  notified  Parker  that  an  operator  had  experienced  an 
intermittent  rudder  kick  and  hardover  condition  during  flights  at  high  altitude  and  that  the 


According  to  the  report,  a  Parker  facility  had  previously  examined  the  unit,  found  no  fault  with  it, 
and  returned  it  to  the  customer. 
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PCU  had  been  removed  and  overhauled  at  a  repair  station.  According  to  the  report,  after 
the  PCU  was  reinstalled  on  another  airplane  in  the  operator’s  fleet,  that  airplane  also 
experienced  a  “rudder  kick  and  hardover  condition.”  Boeing  requested  that  the  operator 
remove  the  PCU  and  send  it  to  Parker  for  detailed  analysis.  When  tested  at  room 
temperature,  the  PCU  passed  all  of  Parker’s  acceptance  tests  except  the  linkage  breakout 
friction  test  in  both  the  extend  and  retract  directions.  When  tested  at  -65°  F,  the  PCU  failed 
the  yaw  damper  system  test.  The  report  stated  that,  after  the  examinations,  the  unit  was 
reassembled,  recertified,  and  returned  to  the  operator. 

Parker  summarized  the  results  of  its  examination  as  follows: 

...a  determination  as  to  the  cause  of  the  rudder  kick  and  hardover  condition 
could  not  be  made  from  the  discrepancies  found  during  testing  and 
disassembly.” 

As  a  result  of  the  USAir  flight  427  accident  and  other  accidents  and  incidents 
involving  apparent  737  directional  control  anomalies,  the  Safety  Board  reviewed  available 
information  regarding  more  than  100  other  737  yaw/roll  upset  events  and  anomalies  that 
were  reported  since  the  737  was  initially  certificated.^^'  Further,  the  Safety  Board 
examined  more  thoroughly  available  data  from  many  of  these  events  for  evidence  that 
servo  valve  jamming  or  other  main  rudder  PCU  anomalies  were  involved  (including  the 
events  described  individually  in  this  report).^^^  When  available,  FDR  and/or  quick  access 
recorder  (QAR)^”  data  from  these  737  events  were  obtained  by  the  Safety  Board  for 
examination,  comparison,  and  evaluation.  The  Safety  Board’s  review  indicated  that  71  of 
the  reported  yaw/roll  events  involved  anomalous  operation  of  the  rudder  system.  In  many 
cases,  the  identified  causes  were  yaw  damper  anomalies;  others  were  attributed  to  rudder 
PCU  anomalies. 

The  Safety  Board  determined  that  several  of  the  anomalous  yaw  damper  events 
were  the  result  of  a  failure  within  the  yaw  damper  rate  gyro,  which  is  located  in  the  yaw 
damper  coupler  in  the  E/E  bay  beneath  the  cabin  directly  behind  the  cockpit.  In  many 
airplanes,  the  forward  lavatory  or  galley  is  located  directly  above  the  E/E  bay,  and  several 


Information  from  Boeing  indicates  that,  between  1990  and  1994  (before  the  USAir  flight  427 
accident)  there  were  187  reported  yaw/roll  events  involving  the  737.  (Yaw/roll  event  reporting  is  mostly 
voluntary.  The  number  of  such  reports  increased  considerably  after  the  USAir  flight  427  accident.)  In 
comparison,  information  from  Boeing’s  Douglas  Products  Division  indicates  that,  over  about  75  million 
flight  hours,  there  had  been  only  3  reported  yaw/roll  events  involving  the  DC-9/MD-80  series  airplanes. 
Information  from  Airbus  indicates  that,  over  about  4  million  flight  hours  as  of  November  1995,  there  had 
been  only  one  reported  yaw  event  involving  the  A-320,  and  that  event  was  caused  by  a  rudder  mistrim. 

See  appendix  E  for  a  complete  list  of  the  112  documented  737  rudder  events  that  were  examined  by 
the  Safety  Board.  This  list  is  not  necessarily  intended  to  suggest  that  the  events  are  similar  to  those  involved 
in  the  USAir  flight  427  accident;  it  is  simply  a  documentation  of  737  yaw/roll  events  that  have  been  reported 
to  and  followed  by  the  Safety  Board.  Additionally,  the  list  is  not  necessarily  a  complete  list  of  all  yaw/roll 
events  because  air  carriers  often  do  not  report  events  in  which  the  yaw/roll  anomaly  ceased  when  the  yaw 
damper  or  autopilot  system  was  disengaged.  Thus,  although  several  air  carriers  have  been  aggressive  about 
reporting  yaw/roll  events  (especially  during  the  months  after  the  USAir  flight  427  accident),  many  such 
events  may  not  have  been  reported. 

QARs  have  greater  data  storage  capabilities  than  FDRs  but  are  primarily  intended  for  air  carrier 
maintenance  fault  analysis.  QARs  are  not  protected/hardened  to  survive  crash  impact  or  fire  conditions. 
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737  yaw  damper  system-related  anomalies  were  found  to  be  the  result  of  fluid 
contamination  (resulting  from  leakage  of  lavatory  fluid,  or  “blue  water”)  of  the  yaw 
damper  coupler,  associated  wires,  and/or  connectors.  (The  737  series  airplanes  have  a 
documented  history  of  blue  water  contamination  and  erosion  see  appendix  F  for  more 
information.)  Another  possible  source  of  yaw  damper  anomalies  that  was  considered  is 
electromagnetic  interference  (EMI)  or  high-intensity  radiated  fields  (HIRF).^^^ 

Several  events  that  appear  to  involve  PCU  servo  valve  and/or  rudder-related 
anomalies  and  may  have  potential  relevance  to  the  flight  control  issues  investigated  in 
connection  with  the  USAir  flight  427  accident  are  discussed  in  the  following  text.  Two 
additional  events  that  also  appear  to  have  potential  relevance  to  the  USAir  flight  427 
accident — the  United  flight  585  accident  and  the  Eastwind  flight  517  incident — were 
discussed  previously  (in  section  1.16.1)  and  are  not  discussed  further  in  this  section. 

July  1992  United  Airlines  Ground  Check  PCU  Anomaly  (737-300) 

On  July  16,  1992,  during  a  preflight  rudder  control  ground  check  at  ORD,  the 
captain  of  a  United  Airlines  737-300  noted  that  the  left  rudder  pedal  stopped  and  jammed 
near  25-percent  pedal  travel.  The  captain  reported  that  he  was  moving  the  rudder  pedals 
more  rapidly  than  usual  when  the  jam  occurred.  He  further  stated  that  the  rudder  pedals 
returned  to  their  neutral  position  after  he  removed  foot  pressure  from  the  left  rudder  pedal. 
The  airplane  returned  to  the  gate,  and  the  main  rudder  PCU  was  removed  for  further 
examination. 

The  main  rudder  PCU  was  tested  and  examined  at  United  Airlines’  facility  in  San 
Francisco,  California,  and  Parker’s  facility  in  Irvine,  California.  The  testing  revealed  that 
the  PCU  exhibited  anomalous  behavior,  ranging  from  sluggish  movement  of  the  actuator 
piston  to  a  full  reversal  in  the  direction  of  piston  travel  opposite  to  the  direction  being 
commanded,  when  the  input  crank  was  fixed  against  the  PCU  body  stops  (to  move  the 
primary  and  secondary  slides  throughout  their  full  travel)  and  the  yaw  damper  piston  was 
in  the  extend  position.  The  testing  also  revealed  high  internal  fluid  leakage.  When 
investigators  tapped  on  the  dual  servo  valve  housing  or  the  summing  levers  or  released  the 
force  on  the  input  crank,  the  PCU  returned  to  normal  operation. 


According  to  Boeing,  the  737  is  not  designed  to  port  excess  blue  water  overboard;  instead,  the 
airplane  is  equipped  with  a  shallow  drip  pan  at  each  lavatory,  which  is  intended  to  catch  spills  and  overflows 
and  prevent  blue  water  contamination/erosion.  However,  737  operators  report  that  the  drip  pan  cannot  catch 
large  spills,  such  as  those  that  result  from  overfilling  the  lavatory  system.  See  section  1.6. 1.1  for  information 
regarding  blue  water  contamination  from  the  accident  airplane’s  maintenance  records. 

EMI  or  HIRE  can  induce  an  electrical  potential  in  electrical  wiring  and  circuits  or  be  received  by  an 
airplane’s  navigational  systems.  Numerous  navigational  anomalies  and  sudden  flight  control  movements  on 
737s  and  other  airplanes  have  been  attributed  to  EMI  (generated  by  on-board  portable  devices,  such  as 
laptop  computers,  electronic  games,  or  cellular  telephones)  or  HIRE  (generated  from  outside  sources,  such 
as  radio  towers,  radar  sites,  and  power  stations).  Technical  literature  indicates  that  it  is  possible  for  EMI  or 
HIRE  to  affect  an  airplane’s  autopilot  or  yaw  damper  system  up  to  the  limits  of  the  system.  See  Shooman, 
M.L.  “A  Study  of  Occurrence  Rates  of  Electromagnetic  Interference  to  Aircraft  with  a  Focus  on  HIRE. ...” 
National  Aeronautics  and  Space  Administration,  Langley  Research  Center,  Hampton,  Virginia,  April  1994, 
pp.  2, 7,  and  20.  Also  see  Flight  Standards  Information  Bulletin  for  Airworthiness  97-16A,  “Lightning/High 
Intensity  Radio  Frequency  Protection  Maintenance,”  Federal  Aviation  Administration,  August  4,  1997. 
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Further  examination  of  the  servo  valve  components  showed  that  the  secondary 
slide  could  move  axially  beyond  its  designed  operating  position  (overtravel),  resulting  in 
abnormal  porting  of  hydraulic  fluid.  When  the  secondary  slide  overtraveled  to  its 
mechanical  stop  (internal  stop)  in  the  servo  valve  housing,  the  abnormal  flow  could 
produce  full  pressure  opposite  to  that  intended  at  the  actuator  piston.  Thus,  the  rudder 
would  move  in  a  direction  opposite  to  the  commanded  direction;  for  example,  rudder  input 
intended  to  command  left  rudder  could  result  in  the  rudder  moving  right. 

The  Safety  Board’s  examination  of  this  servo  valve  revealed  that  overtravel  of  the 
secondary  slide  occurred  when  the  rudder  pedals  were  moved  rapidly  to  command  a 
maximum  rate  of  rudder  travel  or  when  a  pedal  was  fully  depressed  to  command  full 
deflection  of  the  rudder.  During  subsequent  tests,  the  overtravel  of  the  secondary  slide  was 
determined  to  be  the  result  of  the  failure  of  the  secondary  summing  lever  to  maintain 
contact  with  its  respective  external  stop.  Examination  of  the  summing  levers  revealed  that 
the  secondary  summing  lever  did  not  meet  design  specifications  in  that  the  chamfer^^®  on 
the  summing  lever  was  50°,  rather  than  the  specified  45°,  at  the  point  where  it  contacted 
the  external  stop.  This  anomaly  allowed  the  secondary  summing  lever  to  move  beyond  its 
external  stop;  thus,  the  secondary  slide  and  summing  lever  could  continue  to  move  beyond 
the  normal  range  of  travel  until  the  secondary  slide  bottomed  out  at  its  internal  stop  in  the 
servo  valve  housing.^^’ 

As  a  result  of  its  investigation  of  this  incident,  the  Safety  Board  became  concerned 
about  the  potential  for  rudder  reversal  in  all  737  main  rudder  PCUs,  specifically,  that  the 
internal  stops  of  the  dual-concentric  servo  valve  could  allow  sufficient  movement  to  route 
hydraulic  fluid  through  a  flow  passage  located  outside  the  normal  valve  operating  range, 
resulting  in  movement  in  the  direction  opposite  to  the  control  input.  On  November  10, 
1992,  the  Safety  Board  issued  Safety  Reconunendations  A-92-120  and  -121. 

Safety  Recommendation  A-92-120  asked  the  FAA  to 

Issue  an  airworthiness  directive  mandating  design  changes  for  main  rudder 

PCU  servo  valves  that  would  preclude  the  possibility  of  rudder  reversal 

attributed  to  the  overtravel  of  the  secondary  slide. 

On  March  3,  1994,  AD  94-01-07  became  effective  (see  sections  1.6. 3. 2.1  and 
1.18.5).  Because  the  Safety  Board  determined  that  the  AD  satisfied  the  intent  of  Safety 
Recommendation  A-92-120,  it  was  classified  “Closed — Acceptable  Action”  on 
August  11,  1994. 


A  chamfer  is  an  oblique  face  located  at  a  comer  (a  beveled  edge). 

The  servo  valve  was  designed  to  prevent  abnormal  flow  if  the  secondary  slide  bottomed  out  at  its 
internal  stop;  however,  during  the  investigation  of  this  incident,  it  was  discovered  that  parts  built  within 
tolerances  could  be  assembled  with  a  resulting  tolerance  buildup  that  would  allow  the  abnormal  flow  to 
occur  if  the  secondary  slide  moved  to  its  internal  stop.  Thus,  in  addition  to  the  potential  for  overtravel 
because  of  the  incorrect  chamfer,  it  became  evident  that  the  secondary  slide  could  also  be  forced  into  the 
overtravel  range  if  it  became  jammed  to  the  primary  slide.  Normal  movement  of  the  primary  slide  could 
produce  a  rudder  reversal  if  a  primary  to  secondary  slide  jam  existed. 
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Safety  Recommendation  A-92-121  asked  the  FA  A  to 

Conduct  a  design  review  of  servo  valves  manufactured  by  Parker  Hannifin 
that  have  a  design  similar  to  the  737  rudder  power  control  unit  servo  valve 
that  control  essential  flight  control  hydraulic  power  control  units  on 
transport-category  airplanes  certificated  by  the  Federal  Aviation 
Administration  to  determine  that  the  design  is  not  susceptible  to  inducing 
flight  control  malfunctions  or  reversals  due  to  overtravel  of  the  servo 
slides. 

On  January  19,  1993,  the  FAA  stated  that  it  had  completed  a  design  review  of  the 
servo  valves  manufactured  by  Parker  on  all  transport-category  airplanes.  The  FAA  stated 
that  its  review  indicated  that  the  problem  identified  in  this  incident  investigation  existed 
only  in  the  main  rudder  PCU  on  the  737  airplane.  Because  this  design  review  met  the 
intent  of  Safety  Recommendation  A-92-121,  it  was  classified  “Closed — Acceptable 
Action”  on  June  10,  1993.  (See  section  1.18.11.3  for  additional  information  regarding 
these  recommendations  and  two  others  related  to  this  incident.) 

British  Airways  incident  (747-436,  G-BNLY) 

On  October  7, 1993,  a  British  Airways  747-436,  G-BNLY,  experienced  an  in-flight 
upset  as  the  airplane  climbed  through  100  feet  agl  during  its  departure  from  London’s 
Heathrow  Airport.  The  airplane  suddenly  pitched  down  from  14  to  8°  nose  up  because  of 
uncommanded  downward  travel  of  the  elevators  on  the  right  side  of  the  airplane.  The 
flight  crew  maintained  control  of  the  airplane  and  landed  uneventfully  at  Bangkok, 
Thailand,  the  flight’s  intended  destination.  The  incident  was  investigated  by  the  AAIB. 

The  elevators  on  the  747-400  are  not  interconnected.  Postincident  examination  of 
the  airplane’s  QAR^^*  indicated  that  the  elevators  on  the  right  side  of  the  airplane  moved 
to  near  their  maximum  downward  deflection  limit.  The  elevators  on  the  left  side  of  the 
airplane  moved  upward  to  counter  the  right-side  downward  deflection,  which  allowed 
recovery  of  the  airplane.  The  AAIB’s  investigation  revealed  that  failure  of  the  inboard 
elevator  PCU  occurred  because  the  servo  valve  secondary  slide  overtraveled  to  the 
internal  retract  stop  and  that  the  primary  slide  had  moved  to  the  limit  of  the  extend  linkage 
stop.  (The  747  elevator  PCU,  as  with  the  737  main  rudder  PCU,  contains  dual-concentric 
servo  control  valves  and  is  manufactured  by  Parker.) 

The  AAIB  issued  its  final  report  on  this  accident  on  December  14,  1994.^^^  The 
report  identified  the  following  causal  factors: 

The  secondary  slide  of  the  servo  valve  of  the  inboard  elevator  Power 
Control  Unit  (PCU)  was  capable  of  overtravelling  to  the  internal  retract 
stop;  with  the  primary  slide  moved  to  the  limit  imposed  by  the  extend 


In  testimony  at  the  Safety  Board’s  January  1995  public  hearing  session  regarding  USAir  flight  427, 
the  AAIB  investigator  stated  that,  without  the  information  available  on  the  QAR,  the  event  would  have 
probably  been  attributed  to  a  wake  vortex  encounter  rather  than  an  elevator-related  anomaly. 

See  Air  Accidents  Investigation  Branch.  1994.  Report  on  the  incident  to  Boeing  747-436,  G-BNLY, 
at  London  Heathrow  Airport  on  7  October  1993.  Aircraft  Accident  Report  1/95. 
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linkage  stop,  the  four  chambers  of  the  actuator  were  all  connected  to  both 
hydraulic  supply  and  return,  the  servo  valve  was  in  full  cross-flow  resulting 
in  uncommanded  full  down  travel  of  the  right  elevators. 

A  change  to  the  hydraulic  pipework  associated  with  the  right  inboard 
elevator  Power  Control  Unit  was  implemented  on  the  Boeing  747-400 
series  aircraft  without  appreciation  of  the  impact  that  this  could  have  on  the 
performance  of  the  unit  and  consequently  on  the  performance  of  the 
aircraft  elevator  system,  in  that  it  could  exploit  the  vulnerability  of  the 
servo  valve  identified  in  (i)  above. 

As  a  result  of  its  investigation,  the  AAIB  recommended  that  the  Safety  Board 
“consider  re-issuing  safety  recommendation  A-92-121  [asking  the  FAA  to  determine 
whether  servo  valves  in  other  than  those  in  the  737  PCU  could  induce  flight  control 
malfunctions  or  reversals]  to  verify  that  its  full  intent  has  been  met.”  Page  22  of  the  AAIB 
final  report  stated  that  Boeing  was  queried  about  what  consideration  it  gave  to  the  747 
inboard  elevator  PCU  based  on  the  Safety  Board’s  Safety  Recommendation  A-92-121  and 
that  Boeing  replied: 

Parker  did  an  analysis  to  support  the  NTSB  recommendation.  Parker 
looked  at  all  possible  jam  positions  with  pilot  limiting  linkage  stops, 
specifically  with  the  primary  slide  jammed  at  null  and  determining  possible 
reversals.  There  were  no  discrepancies  uncovered  and  therefore  no  actions 
taken.  The  extreme  stop  condition  was  not  envisioned  at  the  time. 

In  connection  with  its  investigation  of  the  USAir  flight  427  accident  and  because 
of  its  continuing  concern  about  the  potential  for  failure  of  the  PCU  servo  valves  in  other 
designs  and  applications,  the  Safety  Board  issued  Safety  Recommendation  A-96-117  on 
October  18,  1996.  Safety  Recommendation  A-96-117  requested  the  FAA  to 

Conduct  a  detailed  design  review  of  all  dual-concentric  servo  control 
valves  that  control  essential  flight  control  system  actuators  on  transport- 
category  airplanes  certificated  by  the  FAA  to  determine  if  the  design  is 
susceptible  to  inducing  flight  control  malfunctions  and/or  reversals  as  a 
result  of  unexpected  improper  positioning  of  the  servo  slides.  If  the  design 
is  determined  to  be  susceptible,  mandate  appropriate  design  changes. 

On  May  13, 1998,  the  FAA  stated  that  its  detailed  design  review  of  dual-concentric 
servo  valves  would  address  the  intent  of  this  safety  recommendation.  However,  on 
February  2,  1999,  the  Safety  Board  indicated  that  airplanes  produced  by  Airbus  were  not 
included  in  the  FAA’s  review.  Pending  the  Safety  Board’s  review  of  the  FAA’s  detailed 
design  review,  including  information  on  Airbus  airplanes.  Safety  Recommendation 
A-96-117  was  classified  “Open — Acceptable  Response.”  (See  section  1.18.11.5  for 
additional  information  regarding  this  recommendation.) 

Sahara  India  Airlines  Training  Flight  Accident  (737-200,  VT-SIA) 

On  March  8,  1994,  a  Sahara  India  Airlines  737-200,  VT-SIA,  was  on  a  training 
flight  when  it  experienced  a  loss  of  control  during  initial  climbout  after  takeoff  at  the 
Palam  Airport  in  New  Delhi,  India.  The  airplane  crashed  on  an  airport  ramp  area,  caught 
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fire,  and  collided  with  a  parked  Aeroflot  IL-86  near  the  international  terminal.  The  four 
pilots  on  board  the  737  (three  pilots-in-training  and  one  instructor  pilot)  and  five 
individuals  on  the  ground  were  killed,  and  four  individuals  on  the  ground  received  serious 
injuries.  The  final  accident  investigation  report,  issued  in  November  1996,^'^°  stated  that 
the  cause  of  the  accident  was  “the  application  of  wrong  rudder  by  [the]  trainee 
pilot.. .during  [an]  engine  failure  exercise.” 

On  November  14,  1994,  the  main  rudder  PCU  from  the  Sahara  Airlines  737  was 
examined  at  Parker’s  facility  in  Irvine,  California,  under  the  supervision  of  Safety  Board 
investigators.  Examination  of  the  PCU  revealed  that  the  unit  had  apparently  been  serviced 
at  a  facility  other  than  the  manufacturer  and  that  a  different  serial  number  had  been  applied 
to  the  PCU.  A  servo  valve  test  was  performed  to  simulate  a  jammed  primary  slide  and 
subsequent  overtravel  of  the  secondary  slide.  The  test  indicated  that  the  PCU  could 
reverse  if  the  primary  slide  was  jammed  to  the  secondary  slide  and  the  rudder  was  moved 
rapidly  or  to  its  limits.  According  to  Parker  personnel,  the  PCU  spring  guide  appeared  to 
have  been  modified  to  a  different  configuration  (one  which  would  have  fit  a  Boeing  707). 
Parker  personnel  attributed  the  PCU’s  reversal  potential  to  the  use  of  this  modified  spring 
guide,  which  permitted  more  overtravel  than  a  properly  configured  spring  guide  would 
have.  It  was  not  possible  to  determine  where  the  spring  guide  had  been  reworked  or  when 
it  had  been  installed. 

On  December  5,  1994,  the  U.S.  Accredited  Representative  to  the  Sahara  accident 
(under  the  provisions  of  Annex  13  to  the  Convention  on  International  Civil  Aviation) 
advised  the  Indian  Court  of  Inquiry  of  the  incorrect  spring  guide  installation  and  the 
resultant  potential  for  reverse  rudder  operation.  In  a  June  6,  1995,  letter,  the  U.S. 
Accredited  Representative  advised  the  Indian  Court  of  Inquiry  that  the  final  report 
regarding  the  Sahara  accident  did  not  mention  the  PCU-related  findings.  The  Safety  Board 
did  not  receive  a  response  to  either  of  these  letters. 

Continental  Airlines  Flight  1057  (737-300,  N17344) 

On  April  11,  1994,  Continental  Airlines  flight  1057,  a  737-300,  N17344, 
experienced  flight  control  anomalies  during  a  flight  between  Houston,  Texas,  and 
Tegucigalpa,  Honduras.  The  flight  crew  diverted  to  San  Pedro  Sula,  Honduras,  and  made  a 
successful  emergency  landing.  During  postincident  interviews,  the  pilots  reported  that 
they  were  in  cruise  flight  at  FL  370  when  they  heard  a  muffled  boom  and  felt  an 
uncommanded  yaw  and  roll  to  the  right.  The  pilots  applied  full  opposite  aileron  to 
counteract  the  roll  and  disengaged  the  autopilot;  however,  they  reported  that  control  wheel 
forces  were  high  for  the  remainder  of  the  flight.  The  pilots  reported  that  they  maintained 
higher-than-normal  airspeeds  for  improved  controllability  during  the  approach  and 
landing. 

Review  of  the  FDR  information  revealed  that  the  yaw/roll  event  was  consistent 
with  a  2.5°  sustained  rudder  input,  which  was  consistent  with  the  yaw  damper  authority 


Report  on  Accident  to  Sahara  India  Airlines  737  Aircraft  VT-SIA  During  Training  Flight  at  IGI 
Airport,  Delhi,  on  March  8,  1994.  Indian  Director  General — Civil  Aviation,  November  1996. 
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for  the  given  flight  conditions  (241  knots  at  37,000  feet  msl).  Postincident  examination  of 
the  airplane’s  yaw  damper  revealed  a  higher-than-normal  output  voltage  on  the  rate  gyro 
of  the  yaw  damper  coupler.  Further  examination  of  the  yaw  damper  revealed  an 
intermittent  open  resistance  condition  in  the  yaw  damper  engage  solenoid  valve;  this 
condition  could  allow  the  voltage  from  the  PCU  to  build  up  over  time  within  the  yaw 
damper  coupler  and  result  in  a  maximum  yaw  damper  command.  The  cause  of  the 
intermittent  yaw  damper  engage  solenoid  operation  was  determined  to  be  hydraulic  fluid 
contamination  of  the  solenoid’s  coil  assembly.  On  June  9,  1997,  the  FAA  issued 
AD  97-09-15,  which  requires  replacing  the  yaw  damper  engage  solenoid  with  a  solenoid 
that  has  encapsulated  electrical  coils  to  prevent  the  intrusion  of  hydraulic  fluid.  The 
solenoid  was  to  be  replaced  the  next  time  the  PCU  is  repaired  or  within  5  years  or  15,000 
flight  hours  from  the  AD’s  date  of  issuance. 

British  Airways  Maintenance  Test  Fiight  incident  (737-236,  G-CBJI) 

On  October  22,  1995,  a  British  Airways  737-236,  G-CBJI,  experienced  several 
yaw/roll  oscillations  during  a  postmaintenance  test  flight.  The  pilots  were  preparing  to  test 
the  passenger  oxygen  mask  automatic  deployment  system  at  an  altitude  of  about  20,000 
feet  msl  and  an  airspeed  of  290  knots  when  the  oscillations  began.  The  pilots  disconnected 
the  autopilot  and  autothrottle  system,  and  the  captain  reported  that  he  believed  he  turned 
off  the  yaw  damper  system;  however,  the  oscillations  continued.  The  oscillations 
exceeded  10°  of  bank  with  a  period  between  peaks  of  about  2  seconds.  The  flight  crew 
declared  an  emergency  and  started  a  descent  back  to  the  departure  airport  (London’s 
Gatwick  Airport).  At  an  altitude  of  about  7,000  feet  msl  and  an  airspeed  of  250  knots,  the 
oscillations  began  to  decrease  in  severity  and  subsequently  stopped  completely.  The  pilots 
landed  the  airplane  at  Gatwick  Airport  without  further  incident. 

The  incident  was  investigated  by  the  AAIB,  which  determined  that  the  cause  of  the 
yaw/roll  oscillations  was  corrosion  of  a  multipin  electrical  connector  inside  the  yaw 
damper  coupler.  The  failure  resulted  in  the  yaw  damper  moving  the  rudder  back  and  forth 
within  the  yaw  damper  limits  (±  2°  on  this  airplane).  The  combination  of  rudder 
oscillations,  air  density,  and  airspeed  allowed  for  excitation  of  the  airplane’s  natural 
frequency  in  the  dutch  roll  mode.  Once  the  airplane  descended  to  denser  air  and  reduced 
airspeed,  the  excitation  was  damped  and  the  oscillations  stopped. 

The  AAIB’s  investigation  found  that  the  corrosion  in  the  electrical  connector  was 
most  likely  the  result  of  leakage  from  the  forward  lavatory  or  galley.  Additionally,  the 
investigation  revealed  that  it  might  be  possible  to  “generate  stray  current  paths  capable  of 
sustaining  engagement  of  the  yaw-damper  system  when  selected  to  OFF,  but  only  in  the 
presence  of  a  high  resistance  in  the  engage-switch  earth  [ground]  path.” 

As  a  result  of  this  incident  and  others  involving  fluid  contamination  of  the  737  E/E 
bay  components,  Boeing  created  an  assessment  team  to  investigate  the  problem  and 
recommend  solutions.  Appendix  F  provides  information  about  the  assessment  team’s 
activities,  composition,  and  recommendations. 
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Delta  Air  Lines  Incident  (737-200,  N377DL) 

On  August  13,  1998,  a  Delta  Air  Lines  737-200,  N377DL,  experienced  a  yaw/roll 
event  while  en  route  from  Houston  to  Cincinnati,  Ohio.  The  event  occurred  while  the 
airplane  was  in  cruise  flight  at  FL  330  in  the  vicinity  of  Memphis,  Tennessee.  The  airplane 
was  operating  on  the  autopilot  and  in  the  “heading  select”  and  “altitude  hold  modes  with 
the  autothrottles  engaged.  The  pilot  stated  that  the  first  irregularity  he  noted  was  that  the 
airplane  did  not  turn  when  the  heading  bug  was  moved  a  few  degrees.  He  noted  that  the 
control  wheel  was  not  centered  so  he  added  rudder  trim  and  disengaged  the  autopilot.  He 
then  reengaged  the  autopilot,  but  rudder  trim  was  required  again.  About  5  minutes  after 
reengaging  the  autopilot,  the  airplane  made  an  abrupt  uncommanded  right  turn.  The  pilot 
said  that  he  then  took  the  controls,  disengaged  the  autopilot,  and  applied  left  rudder  and  “a 
little  left  aileron.”  He  did  not  turn  off  the  yaw  damper.  The  pilot  stated  that  he  thought  the 
airplane  had  lost  an  engine.  After  the  event,  the  flight  continued  uneventfully  and  landed 
in  Cincinnati.  The  pilot  made  a  maintenance  entry  regarding  the  autopilot,  and  the  airplane 
was  decommissioned  by  Delta  maintenance  for  the  subsequent  flight. 

The  FDR  on  the  airplane  recorded  11  parameters,  but  rudder  surface  or  rudder 
pedal  position  were  not  among  those  parameters.  Examination  of  the  FDR  and  radar  data 
revealed  that  on  the  flight  from  Houston  to  Cincinnati,  while  at  an  altitude  of  34,000  feet 
and  an  airspeed  of  320  knots  on  a  northerly  heading,  the  airplane  experienced  a  right 
heading  excursion  of  4.2°  within  1  second.  The  airplane’s  bank  angle  changed  from  about 
1°  RWD  to  about  13°  RWD  within  2  seconds  of  the  initial  heading  change.  After  the  4.2° 
heading  change,  the  airplane’s  heading  increased  in  an  oscillatory  manner  until  the 
airplane  was  steadied  after  a  total  heading  change  of  7°.  The  heading  was  stabilized  within 
20  seconds  of  the  initial  heading  excursion. 

On  the  subsequent  flight,  the  same  airplane  experienced  a  yaw/roll  event  while  en 
route  from  Cincinnati  to  Greensboro,  North  Carolina.  The  flight  crew  reported  that  the 
airplane  abruptly  yawed  left  and  then  started  to  roll  left.  The  captain  reported  that,  during 
this  left  yaw  event,  he  had  to  apply  considerable  right  control  wheel  input  to  maintain 
wings-level  flight.  The  flight  crew  reported  that  the  yaw  stopped  but  that  the  airplane  then 
yawed  to  the  right  just  past  neutral.  The  flight  crew  then  disengaged  the  yaw  damper.  Both 
crewmembers  reported  that  the  rudder  pedals  “pulsed”  for  the  remainder  of  the  flight. 

Further  examination  of  the  FDR  data  indicated  that,  while  at  a  cruise  altitude  of 
23,000  feet  and  an  airspeed  of  325  knots,  the  airplane  first  experienced  a  left  heading 
change  of  1.6°  within  1  second,  followed  approximately  20  seconds  later  by  a  right 
heading  change  of  2°  within  1  second.  During  the  same  time,  the  airplane’s  roll  angle  was 
between  3°  LWD  and  5°  RWD.  Further  calculations  by  the  Safety  Board  determined  that 
the  rudder  position  changes  necessary  to  produce  the  abrupt  yaws  were  consistent  with  a 
yaw  damper  system  input  to  the  rudder  and  would  not  have  exceeded  the  yaw  damper 
system  authority.  Delta  subsequently  examined  the  main  rudder  PCU  and  yaw  damper 
coupler  and  reported  that  no  anomalies  were  found. 
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1.18.1.1.1  QAR  Data  Findings 

Although  the  origins  of  many  737  yaw/roll  events  were  identified,  some  were  not 
as  easily  explained,  including  the  anomalous  yawing  motions  reported  by  the  pilots  who 
flew  the  United  flight  585  airplane  during  the  month  before  the  accident;  the  accidents 
involving  United  flight  585,  Sahara  India  Airlines,  and  USAir  flight  427;  the  preincident 
Eastwind  Airlines  rudder  “bumps;”  the  Eastwind  flight  517  uncommanded  yaw/roll 
incident;  and  the  SilkAir  accident  (for  more  information  regarding  the  SilkAir  accident, 
see  section  1.16.5.4.1). 

During  its  investigation  of  the  USAir  flight  427  accident,  the  Safety  Board 
contracted  with  Flight  Data  Limited,  in  the  United  Kingdom  to  examine  QAR  data  from 
737s  operating  in  Europe  for  evidence  of  unusual  rudder  activity  and  rudder  movements 
opposite  to  the  control  wheel  movements.  Review  of  the  resultant  QAR  data  (about 
57,000  hours  of  operational  data  from  27  airplanes,  including  rudder  position  and  control 
wheel  position)  indicated  the  following: 

•  737  rudder  position  remained  within  the  yaw  damper  range  of  operation  during 
97  to  98  percent  of  the  samples  (including  departure,  cruise,  and  approach-to- 
landing  phases  of  flight). 

•  737  control  wheel  position  data  showed  that  pilots  were  not  likely  to  exceed 
20°  of  control  wheel  input  during  cruise  flight  (99.9  percent  of  cruise  flight 
control  wheel  position  samples  were  within  20°  of  neutral). 

•  737  control  wheel  position  data  indicated  that  the  control  wheel  remained 
within  20°  of  neutral  in  94.4  percent  of  the  samples  during  the  departure  phase 
of  flight  (between  50  and  5,000  feet  agl)  and  in  95.9  percent  of  the  samples 
during  the  approach-to-landing  phase  of  flight  (between  5,000  and  50  feet  agl). 

1.18.1.2  Recent  Rudder-Related  Events  on  737s  Equipped  With  the  1998 
Redesigned  Servo  Valve 

Parker  redesigned  the  main  rudder  PCU  servo  valve  twice — once  in  response  to 
Safety  Recommendation  A-92-120  and  AD  94-01-07  and  again  after  Safety  Board  testing 
in  1996  revealed  the  potential  for  the  servo  valve  primary  slide  to  overtravel  if  the 
secondary  slide  jammed  to  the  housing.  (See  section  1.18.5  for  additional  information.) 
The  second  redesigned  servo  valve  was  completed  in  1998.  The  following  two  rudder- 
related  events  involved  737s  that  were  equipped  with  the  newly  redesigned  servo  valve: 

United  Airlines  Ground  Check  Rudder  Anomaly  (737-300,  N388UA) 

On  February  19, 1999,  the  flight  crew  of  a  737-300,  N388UA,  operated  by  United 
Airlines  reported  a  stiff  or  sluggish  rudder  response  during  a  pre-takeoff  flight  control 
check  at  Seattle,  Washington.  The  flight  crew  stated  that,  when  left  rudder  pedal  was 
applied,  the  required  pedal  pressure  felt  somewhat  greater  than  normal  and  that  the  right 
pedal  would  only  move  with  an  unusually  large  amount  of  force.  After  the  pilots  repeated 
the  check  several  times  with  similar  results,  they  returned  to  the  terminal  gate. 
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Maintenance  personnel  tested  the  rudder  pedals  and  also  found  that  an  unusual  amount  of 
force  was  required  to  move  the  right  rudder  pedal.  The  maintenance  personnel  further 
found  that  the  force  required  to  move  the  right  rudder  pedal  increased  with  the  rate  of 
input  and  that  the  left  rudder  pedal  required  slightly  more  force  than  that  normally 
experienced. 

The  rudder  system  was  examined,  and  no  discrepancies  were  noted  in  the  cables, 
linkages,  and  push  rods.  The  main  rudder  PCU  was  removed  from  the  airplane.  After  a 
replacement  PCU  was  installed,  the  forces  required  to  move  the  rudder  pedals  returned  to 
normal.  The  airplane  was  then  returned  to  service,  and  no  further  problems  with  the  rudder 
system  have  been  reported. 

The  main  rudder  PCU  (which  was  equipped  with  the  modified  servo  valve  per  AD 
97.14-04  and  had  been  tested  to  check  for  cracking  of  the  secondary  slide  71  flight  hours 
[61  flights]  before  the  anomalous  ground  check  in  Seattle)^^'  was  examined  under  the 
Safety  Board’s  direction  at  United’s  maintenance  facility  in  San  Francisco.  Before 
disassembly,  the  PCU  input  crank  was  noted  to  be  visibly  offset.  Further,  the  PCU  did  not 
pass  Parker’s  standard  acceptance  test  procedure.  After  disassembly  of  the  PCU  servo 
valve,  the  valve  spring  guide  was  found  to  be  mispositioned,  thereby  pushing  the 
secondary  slide  off  center  and  resulting  in  high  leakage  and  an  unequal  amount  of  force 
necessary  to  achieve  a  right  or  left  rudder  input.  After  the  guide  was  properly  positioned, 
the  servo  valve  passed  the  acceptance  test  procedure. 

The  mechanic  who  had  previously  performed  the  test  to  detect  secondary  slide 
cracking  on  the  incident  servo  valve  indicated  to  Safety  Board  investigators  that  the  servo 
valve  was  the  first  one  at  United  to  be  tested  for  such  cracks.  The  mechanic  stated  that, 
after  he  tested  the  servo  valve  for  a  cracked  secondary  slide,  the  PCU  passed  the 
acceptance  test  procedure.  However,  the  mechanic  reported  that  he  then  demonstrated  the 
test  to  detect  secondary  slide  cracking  to  another  United  employee  using  the  same  PCU 
but  that  he  did  not  repeat  the  acceptance  test  procedure  after  completing  the  second 
(demonstration)  test. 

Parker  representatives  indicated  that  implementation  of  the  secondary  servo  valve 
slide  test  procedures  to  detect  cracking  could  have  displaced  and  rotated  the  spring  guide. 
They  also  stated  that  a  mispositioned  spring  guide  should  have  been  noted  during  an 
acceptance  test  procedure  or  after  testing  of  the  rudder  system  when  the  PCU  was  installed 
on  the  airplane.  Additionally,  Parker  representatives  indicated  that  improper  rudder 
response  caused  by  the  mispositioned  spring  guide  should  have  been  noticed  either  during 
flight  control  checks  or  in  flight.  The  Safety  Board’s  investigation  of  this  incident  is 
continuing. 

USAirways  Metrojet  In-flight  Rudder  Movement  (737-200,  N282AU) 

On  February  23,  1999,  a  737-200  operated  by  USAirways  as  Metrojet  flight  2710, 
N282AU,  made  an  emergency  landing  at  Baltimore-Washington  International  Airport 


For  additional  information  regarding  AD  97-14-04,  see  section  1.18.5. 
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(BWI)  after  the  flight  crew  reported  to  ATC  that  it  was  experiencing  control  problems 
with  the  airplane’s  rudder.  The  flight  crew  consisted  of  a  training  captain  and  a  captain 
who  was  receiving  initial  operating  experience  (lOE).  The  training  captain  reported  that, 
while  in  cruise  flight  with  the  autopilot  engaged,  he  noticed  that  the  control  wheel  was 
rotating  to  the  left  but  that  the  airplane  was  not  turning.  The  training  captain  stated  that, 
after  he  disconnected  the  autopilot  and  took  control  of  the  airplane,  he  noticed  that  the 
right  rudder  pedal  was  displaced  at  what  appeared  to  be  full  forward  travel.  The  training 
captain  stated  that  he  had  to  apply  left  aileron  input  and  asymmetric  engine  power  to 
prevent  the  airplane  from  rolling  to  the  right.  Further,  that  captain  reported  that  he  pushed 
on  the  left  rudder  pedal  but  that  it  would  not  move.  The  captain  receiving  lOE  stated  that 
he  also  pushed  on  the  left  rudder  pedal  and  found  that  it  would  not  move.  According  to  the 
pilots,  they  turned  off  the  yaw  damper,  but  the  right  rudder  pedal  remained  displaced.  The 
pilots  reported  that,  after  they  moved  the  hydraulic  system  B  switch  to  the  standby  rudder 
position^'^^  the  rudder  pedals  returned  to  their  neutral  position.  The  flight  crew  reported 
that  the  rudder  pedals  moved,  or  “kicked,”  several  times  during  the  approach  to  landing. 

The  airplane  was  examined  at  BWI  by  Safety  Board  investigators  with 
participation  from  Boeing,  FAA,  USAirways,  ALFA,  and  International  Association  of 
Machinists  and  Aerospace  Workers  representatives.  Investigators  inspected  the  operation 
of  the  rudder  system  from  the  rudder  pedals  to  the  main  rudder  PCU  and  standby  rudder 
PCU  for  any  evidence  of  jamming  or  other  malfunction  that  could  have  caused  the  event 
but  found  no  evidence  of  any  jam.  Investigators  also  tested  the  landing  gear  (by  retracting 
them  while  the  airplane  was  raised  on  jacks)  but  found  no  evidence  of  binding  or  jamming 
in  the  nosewheel  steering  mechanism.  The  main  rudder  PCU  and  a  standby  rudder  PCU 
were  removed  from  the  incident  airplane  at  the  Safety  Board’s  request.  After  replacement 
PCUs  were  installed,  the  airplane  was  returned  to  service.  No  problems  with  the  rudder 
system  have  been  reported  since  the  airplane  reentered  service. 

The  main  rudder  PCU  (which  was  equipped  with  the  modified  servo  valve  per  AD 
97-14-04)  was  removed  from  the  airplane  and  examined  by  investigators  at  Parker’s 
facility  in  Irvine,  California.  The  PCU  passed  all  functional  examinations,  and  the 
subsequent  teardown  examination  found  no  evidence  of  a  jam  or  binding  in  the  servo 
valve.  Examination  of  the  standby  rudder  PCU  revealed  no  discrepancies  and  no  galling  of 
the  input  rod  bearing. 

The  FDR  from  the  incident  airplane  was  examined  at  the  Safety  Board’s 
laboratory.  The  FDR  recorded  11  parameters,  and  rudder  surface  and  rudder  pedal  position 
were  not  among  the  parameters.  Simulation  and  kinematic  studies  of  the  data  are  being 
conducted  by  the  Safety  Board  and  Boeing.  Preliminary  results  of  these  studies  indicate 
that,  during  the  upset,  the  rudder  moved  slowly  to  the  blowdown  limit.  The  Safety  Board's 
investigation  of  this  incident  is  continuing. 


Moving  the  B  hydraulic  system  switch  to  the  standby  rudder  position  removes  B  hydraulic  system 
pressure  from  the  main  rudder  PCU  and  energizes  the  standby  hydraulic  pump,  thus  pressurizing  the  standby 
rudder  PCU. 
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1.18.2  Independent  Technical  Advisory  Panel 

In  January  1996,  the  Safety  Board  formed  an  independent  advisory  panel  to  review 
the  work  accomplished  by  the  Systems  Group  in  the  USAir  flight  427  investigation, 
ensure  that  all  systems  issues  had  been  fully  addressed,  and  provide  guidance  and 
suggestions  to  the  Systems  Group  as  appropriate.  The  six-member  advisory  panel 
consisted  of  five  technical  experts  and  engineers  specializing  in  aircraft  systems  and 
hydraulic  components  from  NASA,  the  FAA,  the  USAF,  and  two  hydraulic  component 
manufacturing  companies  and  one  independent  system  safety  and  reliability  consultant. 
The  advisory  panel  members’  areas  of  specialization  included 

•  failure  analysis, 

•  hydraulic  systems  and  components, 

•  contamination/filtration, 

•  FAA  Critical  Design  Review  (CDR)  team/hydraulics,  and 

•  powered  flight  controls. 

The  advisory  panel’s  initial  meeting  was  held  in  Washington,  D.C.,  on  February  8, 
1996.  At  the  meeting,  the  panel  members  were  presented  with  all  completed  factual 
reports,  test  data,  transcripts  of  public  hearing  testimony,  and  an  outline  of  further  planned 
engineering  tests  and  actions  for  the  USAir  flight  427  accident  as  well  as  pertinent 
information  regarding  the  United  flight  585  accident.  During  the  first  meeting,  one  of  the 
panel  members  stated  that  he  had  worked  on  a  military  fighter  project  that  had  used  a 
control  system  PCU  similar  in  design  to  the  737  main  rudder  PCU.  He  stated  that  an 
accident  caused  by  a  jammed  PCU  occurred  very  early  in  the  initial  production  test  flights. 
According  to  the  panel  member,  the  investigation  of  that  accident  determined  that  the  PCU 
jammed  when  a  sudden  full-rate  input  caused  hot  hydraulic  fluid  to  enter  the  cold  PCU. 
The  panel  member  reported  that  the  thermal  expansion  of  the  inner  parts  of  the  PCU  into 
the  cold  PCU  body  resulted  in  the  jammed  condition. 

The  Systems  Group  developed  thermal  shock  test  plans  and,  with  the  panel’s 
participation,  conducted  these  tests  on  a  new-production  main  rudder  PCU  and  the  USAir 
flight  427  airplane’s  main  rudder  PCU.  (The  results  of  those  tests  are  discussed  in  section 
1.16.5.4.7.) 

In  comments  dated  October  31,  1996,  another  panel  member  stated  that  the 
accident  airplane’s  PCU  servo  valve  had  characteristics  that  might  have  made  it  more 
susceptible  to  binding  than  other  main  rudder  PCU  servo  valves.  That  panel  member 
stated  that  the  characteristics  that  may  have  made  the  accident  PCU  servo  valve  more 
susceptible  to  binding  resulted  from  a  combination  of  factors,  such  as  dirty  hydraulic 
fluid,  thermal  shock,  rapid  input,  and  normal  load  factors.  The  panel  member  further  noted 
that,  although  the  accident  PCU  servo  valve  diametrical  clearances  met  the  specifications 
that  existed  at  the  time  it  was  manufactured,  those  specifications  had  been  refined  since 
that  time.  Other  panel  members  did  not  provide  formal  comments  on  the  thermal  test 
results. 
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In  addition,  the  independent  technical  advisory  panel  was  also  involved  in  the 
following  investigative  activities: 

•  Tests  to  determine  the  effects  of  silting  from  fluid  contamination  on  the  main 
rudder  PCU. 

•  Cable  break  tests. 

•  Review  of  wake  turbulence  encounter  flight  test  data.  The  advisory  panel 
concluded  that  the  forces  involved  in  wake  encounters  were  not  sufficient  to 
produce  a  yaw  of  the  magnitude  observed  (after  the  initial  upset)  in  flight 
dynamics  simulations  of  USAir  flight  427. 

•  Examination  and  hardness  tests  of  the  bent  PCU  actuator  rod.  The  advisory 
panel  concluded  that  the  actuator  rod  exhibited  impact-related  damage  and  that 
the  rod  hardness  was  found  to  be  within  specifications. 

•  Review  of  other  scenarios,  including  (1)  separation  of  rudder  skin,  leading 
edge  slat  failure  over  the  wing,  and  asymmetric  spoilers — the  advisory  panel 
considered  these  were  unlikely  to  have  resulted  in  the  accident  because  of  the 
low  yaw  moments  produced;  (2)  yaw  damper  anomalies — the  advisory  panel 
concluded  that  most  yaw  damper  anomalies  involve  minor  flight  control 
interruptions,  which  would  not  result  in  a  loss  of  aircraft  control;  and 
(3)  foreign  object  jam  at  the  external  stop  or  external  link  that  would  prevent 
return  of  the  input  lever — the  advisory  panel  concluded  that  the  external 
protection  of  the  stop  gap  made  this  scenario  unlikely. 

•  Review  of  available  information  regarding  737  yaw  incidents. 

•  Review  of  1990  revision  to  the  servo  valve  tolerances. 

•  Review  of  maintenance  records  for  the  accident  airplane. 

•  Examination  of  the  mechanical  linkage  and  cables  for  rudder  jam/reversal 
mechanism. 

In  April  1997,  the  independent  technical  advisory  panel  briefed  the  Safety  Board 
on  its  work.  The  panel  recommended  several  areas  for  further  study,  including  the  thermal 
shock  phenomenon,  the  servo  valve’s  tight  diametrical  slide  clearances,  possible  causes  of 
linkage  binding,  and  the  effects  of  silting.  The  Safety  Board  conducted  further  study  in 
some  of  these  areas.  In  September  1997,  the  advisory  panel’s  formal  efforts  ended,  but 
individual  members  of  the  panel  continued  to  be  contacted  for  consultation  as  needed  by 
the  Safety  Board. 

1.18.3  Boeing  737  Certification  Requirements  and  information 

1.18.3.1  Initial  Certification  of  the  737-100  and  -200  Series 

The  Boeing  737  design  was  conceived  in  the  early  1960s,  and  the  original  type 
certificate  (which  included  the  737-100  and  -200  series  airplanes)  was  issued  in  December 
1967.  According  to  original  type  certification  documentation,  Boeing  performed  analysis 
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and  testing  and  demonstrated  compliance  with  the  type  certification  requirements  that 
were  contained  in  14  CFR  Part  25  at  that  time. 

When  the  737-100  and  -200  series  airplanes  were  certificated,  14  CFR  Section 
25.695,  entitled  “Power-boost  and  power-operated  control  system,”  stated  the  following: 

(c)  The  failure  of  mechanical  parts  (cables,  pulleys,  piston  rods  and 
linkages)  and  the  jamming  of  power  cylinders  must  be  considered  unless 
they  are  extremely  remote. 

According  to  transcripts  of  meetings  attended  by  FAA  and  Boeing  personnel  on 
May  4  and  5,  1965,  FAA  certification  personnel  raised  questions  during  the  737-100  and 
-200  certification  process  about  the  airplane’s  single-panel,  power-actuated  rudder  design. 
At  that  time,  Boeing  personnel  stated  that  redundancy  was  provided  by  the  dual- 
concentric  PCU  servo  valve  and  dual  load  path  design^^^  of  the  rudder  actuator  system. 
The  Boeing  officials  indicated  that  the  servo  valve  assembly  was  designed  to 
accommodate  a  single  jam  (primary  slide  to  secondary  slide  or  secondary  slide  to  housing) 
without  resulting  in  a  loss  of  control  of  the  PCU  because,  if  either  the  primary  or 
secondary  slides  were  to  jam,  the  other  slide  should  still  move  to  counteract  the  jam  and 
connect  the  proper  flow  paths  to  command  rudder  movement  in  the  intended  direction. 
Boeing  officials  also  acknowledged  that  such  a  single  jam  could  remain  undetected  until 
the  valve  assembly  was  removed  and  examined  and  that  a  single  jam  might  not  be 
perceptible  to  the  pilot  during  normal  operations,  although  it  would  result  in  a  slower 
rudder  movement  and  a  reduced  hinge  moment. 

During  the  737  initial  certification  process,  Boeing  provided  the  FAA  with  a 
failure  analysis  of  possible  malfunctions  of  the  rudder  control  system  (Boeing  document 
D6-14072,  dated  March  1967).  In  addressing  several  possible  rudder  control  system 
failures,  this  analysis  stated  repeatedly  that  a  jammed  rudder  or  rudder  control  system 
could  be  “countered  by  the  use  of  the  lateral  [roll]  control  system.”  The  Boeing  analysis 
also  stated  that  the  737’s  “lateral  [roll]  control  authority  exceeds  the  rudder  control 
authority  at  any  rudder  angle  it  would  be  reasonable  to  expect  the  pilot  to  command  under 
all  flight  conditions”  and  that  lateral  control  authority  could  therefore  be  used  “to 
overcome  the  effect  of  a  jammed  rudder  control  system  or  loss  of  rudder  control.’ 
Further,  in  specifically  addressing  the  requirements  of  14  CFR  Section  25.695(c),  Boeing 
stated  in  the  March  1967  failure  analysis  report  that  “...in  the  event  of  a  jamming  failure 


243  “gxtremely  remote”  was  not  specifically  defined,  and  a  mathematical  probability  was  not  officially 
provided.  However,  during  postaccident  discussions,  several  FAA  aircraft  certification  representatives  stated 
their  belief  that  extremely  remote  was  essentially  a  probability  of  1  x  10  *  or  less  for  each  flight  hour. 

The  dual  load  path  design  provides  two  structurally  redundant  paths  for  inputting  pilot  commands  to 
the  main  rudder  PCU,  including  separate  and  independent  linkages,  levers,  and  cranks,  so  that  a  failure  or 
malfunction  in  one  load  path  will  not  affect  the  proper  operation  of  the  PCU.  The  redundant  paths  are 
created  by  the  use  of  redundant  designs  (such  as  a  push  rod  within  a  push  rod  or  a  fastener  within  a  fastener) 
or  mirror-image  designs  (for  levers,  linkages,  and  cranks). 

This  statement  was  made  in  the  context  of  addressing  the  effects  of  a  failure  of  the  manual  control 
system  between  the  rudder  pedals  and  the  forward  rudder  quadrants  at  the  pilots  stations. 
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that  immobilizes  the  rudder  system[,]  yaw  control  can  be  maintained  through  the  use  of 
lateral  [roll]  control.” 

1 .18.3.2  Regulatory  Changes  Made  After  Certification  of  the  737-100 
and  -200  Series  (Sections  25.671  and  25.1 309) 

In  April  1970,  the  FAA  issued  amendment  25-23  to  14  CFR  Part  25.  According  to 
the  FAA,  the  amendment  was  intended  “to  improve  the  airworthiness  requirements 
applicable  to  the  type  certification  of  transport  category  airplanes.”  (35  Federal  Register 
5665,  April  8, 1970.)  Among  the  new  requirements  promulgated  in  the  amendments  were 
those  in  Section  25.671  (which  appears  in  Subpart  D  of  Part  25,  “Design  and 
Construction,”  and  supersedes  the  requirements  of  25.695).  Section  25.671,  entitled 
“General,”  states  in  part: 

(c)  The  airplane  must  be  shown  by  analysis,  tests,  or  both,  to  be  capable  of 
continued  safe  flight  and  landing  after  any  of  the  following  failures  or 
jamming  in  the  flight  control  system  and  surfaces  (including  trim,  lift,  drag, 
and  feel  systems),  within  the  normal  flight  envelope,  without  requiring 
exceptional  piloting  skill  or  strength. Probable[^  malfunctions  must 
have  only  minor  effects  on  control  system  operation  and  must  be  capable  of 
being  readily  counteracted  by  the  pilot. 

(1)  Any  single  failure,  excluding  jamming  (for  example,  disconnection 
or  failure  of  mechanical  components,  such  as  actuators,  control 
spool  housing,  and  valves). 

(2)  Any  combination  of  failures  not  shown  to  be  extremely 
improbable,^'**]  excluding  jamming  (for  example,  dual  electrical  or 
hydraulic  system  failures,  or  any  single  failure  in  combination  with 
any  probable  hydraulic  or  electrical  failure). 

(3)  Any  jam  in  a  control  position  normally  encountered[^'*’]  during 
takeoff,  climb,  cruise,  normal  turns,  descent,  and  landing  unless  the 
jam  is  shown  to  be  extremely  improbable,  or  can  be  alleviated. 

A  runaway  of  a  flight  control  to  an  adverse  position  and  jam  must 
be  accounted  for  if  such  runaway  and  subsequent  jamming  is  not 
extremely  improbable. 


The  terms  “normal  flight  envelope”  and  “exceptional  piloting  skill”  are  not  defined  in  the  Federal 
Aviation  Regulations  (FAR).  However,  the  737  AFM  contains  flight  limitations,  such  as  allowable  load 
limits  and  airspeeds  in  the  “Limitations”  section. 

Probable  was  (and  is)  defined  in  FAA  Advisory  Circular  (AC)  25.1309-lA,  “System  Design  and 
Analysis,”  June  21, 1988,  as  a  probability  of  failure  on  the  order  of  greater  than  1  x  10'^  for  each  flight  hour. 

248  “Extremely  improbable”  failure  conditions  are  described  in  FAA  AC  25. 1309-1 A  as  “those  so 
unlikely  that  they  are  not  anticipated  to  occur  during  the  entire  operational  life  of  all  airplanes  of  one  type 
and  “having  a  probability  on  the  order  of  1x10'®  or  less  each  flight  hour,  based  on  a  flight  of  mean  duration 
for  the  airplane  type.” 

The  term  “normally  encountered”  was  not  defined  in  the  FARs.  However,  as  further  discussed  in 
section  1.18.3.4,  the  FAA  defined  a  “normally  encountered”  rudder  position  for  the  737-NG  certification  as 
2.5"  or  less. 
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FAA  Amendment  25-23  also  included  new  requirements  in  Section  25.1309, 
entitled  “Equipment,  Systems,  and  Installations”  (which  appears  under  Subpart  F  of 
Part  25,  “Equipment”).  That  section  states  in  part: 

(a)  The  equipment,  systems,  and  installations,  whose  functioning  is 
required  by  this  subchapter,  must  be  designed  to  ensure  that  they  perform 
their  intended  functions  under  any  foreseeable  operating  condition. 

(b)  The  airplane  systems  and  associated  components,  considered  separately 
and  in  relation  to  other  systems,  must  be  designed  so  that  - 

(1)  The  occurrence  of  any  failure  condition  which  would  prevent  the 
continued  safe  flight  and  landing  of  the  airplane[^^®]  is  extremely 
improbable,  and 

(2)  The  occurrence  of  any  other  failure  conditions  which  would  reduce 
the  capability  of  the  airplane  or  the  ability  of  the  crew  to  cope  with 
adverse  operating  conditions  is  improbable.[^^'] 

(c)  Warning  information  must  be  provided  to  alert  the  crew  to  unsafe 
system  operating  conditions,  and  to  enable  them  to  take  appropriate 
corrective  action.  Systems,  controls,  and  associated  monitoring  and 
warning  means  must  be  designed  to  minimize  crew  errors,  which  could 
create  additional  hazards. 

(d)  Compliance  with  the  requirements  of  paragraph  (b)  of  this  section  must 
be  shown  by  analysis,  and  where  necessary,  by  appropriate  ground,  flight, 
or  simulator  tests.  The  analysis  must  consider  - 

(1)  Possible  modes  of  failure,  including  malfunctions  and  damage  from 
external  sources; 

(2)  The  probability  of  multiple  failures  and  undetected  failures; 

(3)  The  resulting  effects  on  the  airplane  and  occupants,  considering  the 
stage  of  flight  and  operating  conditions,  and 

(4)  The  crew  warning  cues,  corrective  action  required,  and  the 
capability  of  detecting  faults. 

The  FAA’s  Advisory  Circular  (AC)  25.1309-lA  describes  various  acceptable 
means  for  showing  compliance  with  the  requirements  of  Section  25.1309(b),  (c),  and  (d). 
According  to  the  AC,  Section  25.1309  requires  that  there  be  “a  logical  and  acceptable 
inverse  relationship  between  the  probability  and  the  severity  of  each  failure  condition, 
such  that  ‘minor’  failure  conditions  may  be  probable,  ‘major’  failure  conditions  must  be 


Such  a  failure  is  referred  to  as  a  “catastrophic”  failure  condition  in  FAA  AC  25. 1309-1  A. 

“Improbable”  failure  conditions  are  described  in  the  FAA’s  AC  25.1309-1  A  as  “those  not  anticipated 
to  occur  during  the  entire  operational  life  of  a  single  random  airplane.  However,  they  may  occur 
occasionally  during  the  entire  operational  life  of  all  airplanes  of  one  type.”  These  conditions  are  further 
defined  as  “those  having  a  probability  on  the  order  of  1  x  10'^  or  less,  but  greater  than  on  the  order  of  1  x  lO  ’ 
each  flight  hour,  based  on  a  flight  of  mean  duration  for  the  airplane  type].” 
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improbable,  and  ‘catastrophic’  failure  conditions  must  be  extremely  improbable.”^^^  The 
AC  provides  the  following  definitions  of  those  failure  conditions: 

•  Minor:  those  that  would  not  significantly  reduce  airplane  safety,  and  which 
involve  crew  actions  that  are  well  within  their  capabilities.  Minor  failure 
conditions  may  include,  for  example,  a  slight  reduction  in  safety  margins  or 
functional  capabilities,  a  slight  increase  in  crew  workload,  such  as  routine 
flight  plan  changes,  or  some  inconvenience  to  occupants; 

•  Major:  those  that  would  reduce  the  capability  of  the  airplane  or  the  a  crew  to 
cope  with  adverse  operating  conditions  to  the  extent  that  there  would  be,  for 
example,  a  significant  reduction  in  safety  margins  or  functional  capabilities,  a 
significant  increase  in  crew  workload  or  in  conditions  impairing  crew 
efficiency,  or  some  discomfort  to  occupants;  or,  in  more  severe  cases,  a  large 
reduction  in  safety  margins  or  functional  capabilities,  higher  workload  or 
physical  distress  such  that  the  crew  could  not  be  relied  on  to  perform  its  tasks 
accurately  or  completely,  or  adverse  effects  on  occupants;  and 

•  Catastrophic:  those  that  would  prevent  continued  safe  flight  and  landing. 

In  a  May  13,  1998,  letter,  the  FAA  Administrator  offered  the  following  additional 
explanation  of  the  term  “catastrophic  failure  condition:” 

A  catastrophic  failure  is  one  that  will  always  result  in  an  accident.  In  the 
case  of  a  dual  slide  jam  in  the  rudder  PCU,  this  condition  will  not  always 
result  in  an  accident.  The  airplane  is  fully  controllable  in  that  configuration 
throughout  much  of  its  flight  envelope.  Thus,  it  is  not  a  catastrophic  event 
as  defined  by  FAA  regulations  and  policy.  Not  being  catastrophic,  the 
regulations  do  not  require  that  the  dual  slide  jam  be  extremely  improbable. 
Nevertheless,  with  the  service  history  and  the  number  of  hours  of  operation 
on  the  737,  the  FAA  believes  a  dual  slide  valve  jam  has  been  shown  to  be 
extremely  improbable  and  in  compliance  with  the  regulations. 

1.18.3.3  Certification  of  the  Boeing  737-300,  -400,  and  -500  Series 
(Derivative  Certification) 

According  to  14  CFR  Section  21.17,  an  applicant  for  a  type  certificate  must  show 
that  the  aircraft  meets  the  applicable  regulatory  requirements  “that  are  effective  on  the 
date  of  application  for  that  certificate.”  However,  according  to  Section  21.19,  when  a 
manufacturer  proposes  a  change  to  an  aircraft  that  has  already  been  certified,  a  new 
application  for  a  new  type  certificate  is  required  only  if 

(a)  The  Administrator  finds  that  the  proposed  change  in  design, 
configuration,  power,  power  limitations  (engines),  speed  limitations 


The  AC  further  states  that  “the  failure  of  any  single  element,  component,  or  connection  during  any 
one  flight.. .should  be  assumed,  regardless  of  its  probability”  and  that  “subsequent  failures  during  the  same 
flight,  whether  detected  or  latent,  and  combinations  thereof,  should  also  be  assumed,  unless  their  joint 
probability  with  the  first  failure  is  shown  to  be  extremely  improbable.” 
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(engines),  or  weight  is  so  extensive  that  a  substantially  complete 
investigation  of  compliance  with  the  applicable  regulations  is  required  [or]; 

(b)  ...the  proposed  change  is.. .in  the  number  of  engines  or  rotors;  or...[t]o 
engines  or  rotors  using  different  principles  of  propulsion  or  to  rotors  using 
different  principles  of  operation. 

Further,  14  CFR  Section  21.101  states  that 

(a)  ...an  applicant  for  a  change  to  a  type  certificate  must  comply  with 
either- 

(1)  The  regulations  incorporated  by  reference  in  the  type  certificate;  or 

(2)  The  applicable  regulations  in  effect  on  the  date  of  the  application, 
plus  any  other  amendments  the  Administrator  finds  to  be  directly 
related. 

(b)  If  the  Administrator  finds  that  a  proposed  change  consists  of  a  new 
design  or  a  substantially  complete  redesign  of  a  component,  equipment 
installation,  or  system  installation,  and  that  the  regulations  incorporated  by 
reference  in  the  type  certificate  for  the  product  do  not  provide  adequate 
standards  with  respect  to  the  proposed  change,  the  applicant  must  comply 
with- 

(1)  The  applicable  [regulatory]  provisions  ...  in  effect  on  the  date  of 
the  application  for  the  change,  that  the  Administrator  finds  necessary  to 
provide  a  level  of  safety  equal  to  that  established  by  the  regulations 
incorporated  by  reference  in  the  type  certificate  for  the  product;  and 

(2)  Any  special  conditions,  and  amendments  to  those  special 
conditions,  prescribed  by  the  Administrator  to  provide  a  level  of  safety 
equal  to  that  established  by  the  regulations  incorporated  by  reference  in 
the  type  certificate  for  the  product. 

When  the  737-300  series  airplane  was  added  to  the  737  type  certificate  in 
November  1984  (followed  by  the  737-400  series  in  1988  and  the  -500  series  in  1990), 
some  updated  regulations  were  added  to  the  type  certification  basis  for  those  models. 
However,  the  certification  basis  for  those  airplanes  consisted  primarily  of  the  same 
certification  requirements  and  design  criteria  that  existed  for  the  original  -100  and  -200 
series  airplanes  (certificated  17  years  earlier).  The  -100  through  -500  series  airplanes  were 
certificated  with  the  original  rudder  system  design. 

According  to  Boeing  and  FAA  personnel,  the  newer  series  737  airplanes  (737-300, 
-400,  -500)  were  derived  from  the  existing  certificated  models  (737-100  and  -200)  and  the 
flight  control  system  designs  for  the  newer  series  airplanes  were  similar  to  the  existing 
models  (and  not  unique  to  the  newer  series  airplane).  The  officials  stated  that  the  FAA 
therefore  did  not  require  Boeing  to  meet  the  certification  requirements  of  14  CFR  Sections 
25.671  or  25.1309.  In  a  November  24, 1998,  letter  to  the  Safety  Board,  the  FAA  stated  that 
“it  is  by  no  means  certain  that  if  [Section]  25.671  amendment  23  had  been  applied  to  the 
original  737  certification,  that  the  system  would  have  been  significantly  different.” 
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According  to  an  appendix  to  Boeing’s  1967  analysis  report  that  was  added  in  1984 
to  address  the  certification  of  the  737-300,  “the  737-300  rudder  control  system  is 
essentially  unchanged  from  the  737-200  design.  Modifications  to  the  737-200  design  have 
been  made  due  to  differences  in  737-300  requirements,  aerodynamic  characteristics,  and 
to  provide  improved  uncontained  engine  failure  protection.  All  of  the  modifications  have 
no  effect  on  the  basic  method  of  system  operation,  failure  modes,  redundancy,  or 
interaction  with  other  systems.”  In  addressing  the  requirements  of  Section  25.695(c),  the 
1984  appendix  stated  that,  in  the  event  of  a  jamming  failure  that  immobilized  the  rudder 
system,  yaw  control  can  be  maintained  through  the  use  of  the  lateral  (roll)  system. 

In  a  separate  failure  analysis  report  pertaining  to  the  737-300,  -400,  and  -500  series 
airplanes  that  addressed  potential  rudder  system  failures  (prepared  by  Boeing  in  February 
1995  at  the  FAA’s  request),  Boeing  indicated  that  lateral  control  authority  would  be 
adequate  to  control  a  rudder  offset  for  a  jam  at  a  normally  encountered  flight  position.  In 
discussing  a  jam  of  the  manual  input  linkage  to  the  hydraulic  control  valve  in  the  main 
rudder  PCU,  the  analysis  report  stated  that  roll  control  authority  “exceeds  the  rudder 
control  authority  for  most  but  not  all  flight  conditions.”  In  discussing  the  effects  of  a  jam 
of  the  main  rudder  PCU  servo  valve’s  primary  or  secondary  slides,  the  analysis  report 
stated  that  “for  most  valve  jams  the  rudder  would  remain  operable  and  no  pilot  action 
would  be  required”  but  that  “for  a  worst  case  jam  [seizure  of  either  the  primary  or  the 
secondary  slide  at  its  fully  deflected  position,  resulting  in  the  loss  of  actuator  force 
capability  in  one  direction]  the  pilot  could  maintain  flight  path  control  using  the  lateral 
control  system.” 

The  Safety  Board  notes  that  the  Boeing  757,  which  was  certificated  in  1982,  was 
designed  with  three  rudder  actuators.  Boeing  indicated  that  the  use  of  three  actuators  on 
that  airplane  allowed  autopilot  control  over  the  rudder  during  autolandings  and  removed 
the  need  to  mass  balance  the  rudder. 

1.18.3.4  Certification  of  the  737-600,  -700,  and  -800  Series 

According  to  the  FAA  type  certification  data  sheets,  Boeing  showed  compliance 
with  most  of  the  current  requirements  of  14  CFR  Part  25,  including  Section  25.671,  during 
certification  of  the  737-600,  -700,  and  -800  series  airplanes  (737-next-generation  [NG] 
series  airplanes).^^^  In  a  November  24, 1998,  letter  to  the  Safety  Board,  the  FAA  indicated 
that  it  had  encouraged  Boeing  to  comply  with  the  newer  regulations  in  certifying  the 
737-NG  series  airplanes  and  that  Boeing  had  elected  to  do  so. 

During  meetings  in  January  and  February  1996,  Boeing,  the  FAA,  and  Joint 
Airworthiness  Authority  representatives  developed  an  agreement  for  an  acceptable  means 


According  to  Boeing,  737-NG  series  airplanes  fly  for  longer  ranges,  at  higher  altitudes,  and  at  faster 
speeds;  use  less  fuel;  and  produce  less  noise  that  the  earlier  series  737s.  The  737-NG  series  airplanes  also 
have  a  longer/wider  wing  with  improved  aerodynamics,  advanced  cockpit  displays,  and  more  powerful 
engines.  Because  of  the  enhanced  engine  power,  the  737-NG  series  airplanes  have  a  larger  rudder  so  that 
airplane  control  can  be  maintained  in  the  event  of  an  engine  failure.  The  main  rudder  PCU  of  the  737-NG 
series  airplanes  is  more  powerful  than  that  used  on  earlier  series  airplanes,  and  the  PCUs  are  therefore  not 
interchangeable. 
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of  showing  737-NG  compliance  with  Section  25.671(c)(3).  The  representatives  agreed 
that  service  history  and  exposure  time  could  be  used  to  show  compliance. 

In  a  February  1996  document  entitled  “Primary  Flight  Controls,  Ground  Spoilers, 
and  High  Lift  System  Certification  Plan,”  Boeing  indicated  that  it  intended  to  show 
compliance  with  Section  25.671(c)(3)  by  design  review,  safety  assessment,  flight  tests  and 
simulations,  and  service  experience.  This  document  also  contained  a  description  of  the 
intended  means  of  compliance,  which  stated  in  part: 

A  system  safety  analysis  will  be  conducted  to  show  that  failure  conditions 
that  could  prevent  continued  safe  flight  and  landing  are  extremely 
improbable.  Design  changes  have  been  made  to  ensure  that  uncommanded 
rudder  motion  is  controllable  with  wheel  in  the  vast  majority  of  the  flight 
envelope.  Means  are  available  on  the  flight  deck  which  will  allow  the 
rudder  to  return  to  the  faired  position.  Jams  causing  uncommanded  motion 
that  could  be  uncontrollable  will  be  shown  to  be  extremely  improbable  due 
to  the  very  short  exposure  time  and  the  very  low  failure  rate  demonstrated 
in  service. 

In  an  April  23,  1996,  letter,  the  FAA  informed  Boeing  that  its  proposed 
certification  plan  for  the  737-NG  was  acceptable  (with  some  exceptions  that  were  not 
relevant  to  Section  25.671).  On  September  29,  1997,  the  FAA  closed  issue  paper  F-2, 
which  addressed  flight  control  jams  for  the  737-NG  series  airplanes.  The  issue  paper 
defined  the  normally  encountered  flight  control  positions  for  the  737-NG,  noting  that 
“applicants  have  generally  been  unable  to  demonstrate  that  it  would  be  extremely 
improbable  for  a  flight  control  jam  to  occur  in  a  control  position  normally  encountered,  or 
that  a  jam  could  be  alleviated”  and  that  “therefore,  it  must  be  shown  that  the  airplane 
retains  structural  integrity,  has  sufficient  remaining  control  authority,  and  is  controllable 
following  such  a  jam,  without  requiring  exceptional  piloting  skill  or  strength.”  The  FAA 
stated  that  a  jam  in  a  flight  control  is  expected  to  occur  approximately  once  every  10 
million  flight  hours.  Boeing  indicated  its  belief  that  a  jam  in  a  flight  control  is  expected  to 
occur  approximately  every  9  million  flight  hours. 

The  FAA  indicated  in  issue  paper  F-2  that,  during  takeoff,  normally  encountered 
roll/yaw  control  positions  were  those  necessary  to  counteract  a  steady  15-knot  crosswind 
and  that  it  would  also  be  necessary  to  consider  approach  and  landing  configurations  to 
address  jams  during  the  final  flight  phase.  The  issue  paper  further  defined  normally 
encountered  roll/yaw  control  positions  after  takeoff  as  the  more  critical  of  one-third  of  the 
total  travel  of  the  control  surface,  the  authority  limit  of  the  yaw  damper,  or  those  positions 
required  to  counter  a  25-foot-per-second  discrete  gust.  In  its  November  24, 1998,  letter  to 
the  Safety  Board,  the  FAA  indicated  that  it  considered  the  normally  encountered  control 
position  for  the  737-NG  series  airplanes  to  be  2.5°  of  rudder,  which  is  approximately  the 
maximum  yaw  damper  authority. 


The  information  in  this  paragraph  and  in  several  of  the  paragraphs  that  follow  is  contained  in  briefing 
materials  prepared  by  Boeing  for  presentations  it  made  to  the  FAA  during  October  1997.  Boeing  provided 
those  briefing  materials  to  the  Safety  Board  in  response  to  its  requests  for  information  pertaining  to 
certification  of  the  737-NG  series  airplanes. 
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Issue  paper  F-2  also  described  Boeing’s  position,  as  indicated  in  a  June  26,  1997, 
document,  that  a  2°  rudder  displacement  should  be  accepted  as  the  maximum  normally 
encountered  position.  Boeing  stated  that  the  “service  history  of  these  systems  on  previous 
models  provides  evidence  to  validate  the  qualitative  evaluations  of  these  areas. 
Additionally,  further  jam  protection  features  have  been  added  to  the  flight  control  system 
for  the  737-600/-700/-800.” 

Boeing  also  stated  that 

...for  areas  of  the  flight  control  system  where  rigid  jams  cannot  be  shown 
to  be  extremely  improbable,  Boeing  plans  to  conduct  analysis  and/or 
testing  to  demonstrate  that  continued  safe  flight  and  landing  is  possible, 
without  requiring  exceptional  piloting  skill  or  strength,  after  a  jam  in  a 
normally  encountered  position.  Based  on  a  review  of  in-service  jam 
incidents,  there  is  no  evidence  which  would  indicate  that  a  jam  failure 
becomes  more  likely  [at]  greater... deflection [s].  From  Boeing  service 
history,  the  probability  of  a  jam  is  less  than  lO'^/flt  hr.  ...therefore, 
evaluation  of  jams  will  be  accomplished  at  the  maximum  control  position 
which  addresses  99%  of  system  operational  exposure  time.  Jams  outside 
the  99%  boundary  are  extremely  improbable  based  on  the  lO'^/flt  hr  failure 
rate.  This  maximum  control  position  will  be  determined  from  a  survey  of 
in-service  and  flight  test  recorded  data. 

According  to  Boeing’s  October  1997  briefing  materials,  the  FAA  informed  Boeing 
on  October  15, 1997,  that  the  737-NG  elevator  and  rudder  control  systems  did  not  comply 
with  Section  25.671(c)(3).  The  FAA  indicated  that  the  definition  of  extremely  improbable 
in  Section  25.671(c)(3)  did  not  allow  the  use  of  exposure  time  and  that  the  possibility  of 
the  jam  itself  must  be  less  than  10'^.  In  its  November  24,  1998,  letter  to  the  Safety  Board, 
the  FAA  indicated  that  it  initially  concluded  that  the  use  of  a  small  exposure  time  (as 
proposed  by  Boeing)  was  not  appropriate  to  show  a  jam  to  be  extremely  improbable.  The 
FAA  stated  that  its  conclusion  was  based  on  the  belief  that  this  type  of  probability  analysis 
had  never  been  used  to  show  compliance  with  Section  25.671(c)(3)  and  that  no  existing 
policy  provided  direction  on  the  use  of  this  type  of  analysis. 

The  briefing  materials  stated  that  Boeing  appealed  the  FAA’s  finding  of 
noncompliance  and  presented  its  position  on  October  22  and  27,  1997,  to  local  FAA 
certification  officials  in  Seattle  and  on  October  28  and  29,  1997,  to  FAA  upper 
management  in  Washington,  D.C.  Boeing’s  position  was  that  a  showing  of  jam  avoidance 
was  permitted  by  Section  25.671(c)(3).  Boeing  stated  that  its  interpretation  of  Section 
25.671(c)(3)  was  that  a  new  airplane  without  a  service  history  must  be  designed  for  jam 
tolerance  but  that  derivative  airplanes  with  a  proven  service  history  could  be  designed  for 
jam  tolerance  where  possible  and  jam  avoidance  in  other  areas.  Boeing  stated  that  the 
FAA’s  interpretation  of  Section  25.671(c)(3)  was  inconsistent  with  the  language  of  the 
rule.  Boeing  cited  AC  25. 1309-1 A,  paragraphs  10a  and  10b,  in  its  argument  that  existing 
FAA  policy  allowed  an  event  to  be  shown  to  be  extremely  improbable  by  multiplying  the 
failure  rate  of  the  jam  by  the  exposure  time  of  the  flight  phase(s)  when  the  jam  would  be 
catastrophic. 
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Boeing  further  asserted  that  the  FAA’s  interpretation  of  Section  25.671(c)(3) 
would  not  have  allowed  a  finding  that  the  Boeing  747,  757,  767,  and  777  complied  with 
that  rule,  even  though  the  FAA  had  already  made  such  findings.  Boeing  indicated  that  its 
proposed  exposure  time-based  analysis  had  been  used  in  past  certifications  of  these 
airplanes  for  failures  that  are  only  catastrophic  during  short  segments  of  flight,  such  as 
rudder  control  on  takeoff  with  an  engine  out,  spoiler  surface  hardover  at  low  altitude, 
autolands.  111  rejected  takeoffs,  and  111  thrust  asymmetry  compensation  failures  on 
takeoff.  Boeing  stated  that  both  the  737-NG  and  lAl  were  exposed  to  rate  jams,  which 
could  result  in  rudder  hardovers  that  would  be  controllable  except  at  a  low  altitude,  and 
that  a  jam  avoidance  design  philosophy  had  been  used  in  the  certification  of  the  747. 
Boeing  argued  that,  because  the  747  and  the  737-NG  have  the  same  certification  basis,  the 
rule  has  not  been  changed,  and  no  advisory  material  has  been  issued,  the  747  precedent 
established  policy  and  an  acceptable  means  of  showing  compliance  with  the  rule. 

Boeing  indicated  that  the  FAA’s  change  in  position  regarding  the  acceptability  of 
Boeing’s  originally  proposed  means  of  showing  737-NG  compliance  came  “late  in  the 
game”  with  no  practical  opportunity  for  a  design  fix.  Boeing  argued  that  the  change  in  the 
FAA’s  past  interpretation  of  the  rule  was  not  justified,  given  the  number  of  flight  hours 
accumulated  by  the  existing  737  series  and  the  design  improvements  incorporated  to 
enhance  the  system,  and  that  the  new  interpretation  had  not  achieved  consensus  across  the 
aviation  industry. 

Boeing  indicated  during  its  October  1997  presentations  to  the  FAA  that  it  did  not 
believe  a  “position  jam”  (defined  by  Boeing  as  one  that  would  occur  in  a  normally 
encountered  position  and  fix  the  rudder  in  a  steady-state  position)  was  an  issue  because 
the  failure  would  be  controllable.  Boeing  indicated  that  rate  jams  (defined  by  Boeing  as 
those  that  would  cause  a  hardover  position  outside  of  that  normally  encountered)  could  be 
caused  either  by  a  dual  slide  jam  or  an  input  arm  jam.  (Boeing’s  presentation  did  not 
address  the  single  jam/reversal  failure  mode.)  According  to  Boeing,  concerns  about  a  dual 
slide  jam  could  be  eliminated  because  of  the  servo  valve’s  dual  concentric  design. 
Further,  Boeing  indicated  that  no  input  arm  rate  jams  had  been  identified  in  the  737  fleet’s 
service  history  and  that,  as  a  result  of  this  finding,  a  design  review,  and  tests,  no  input  arm 
rate  jam  scenario  was  foreseeable.  As  further  protective  measures,  Boeing  cited  the 
addition  of  a  hydraulic  pressure  limiter,  which  would  reduce  the  exposure  time  of  a 
catastrophic  rudder  hardover  to  a  60-  to  90-second  window  on  takeoff  and  landing,  and  a 
rudder  hardover  shutdown  procedure. 

Boeing’s  qualitative  assessment  indicated  that  a  catastrophic  rate  jam  (that  is,  one 
that  would  occur  during  the  60-  to  90-second  exposure  window  at  takeoff  or  landing)  was 
extremely  improbable  based  on  service  experience,  design,  and  limited  exposure. 


Boeing  indicated  that  the  probability  of  a  jam  of  the  primary  slide  was  2.36  x  10'^  and  that  the 
probability  of  a  secondary  slide  jam  was  2.10  x  10'*.  These  calculations  were  based  on  Boeing’s  awareness 
of  7  possible  occurrences  of  a  jam  of  the  primary  slide  in  74  million  flight  hours  and  the  recognition  that  the 
jam  could  be  latent  over  the  entire  mean  time  between  unscheduled  removal  of  the  PCU  (estimated  by 
Boeing  to  be  25,000  hours).  Boeing  indicated  that  there  have  been  no  known  occurrences  of  a  jam  of  the 
secondary  slide  and  that  one  failure  was  assumed  for  the  calculation. 
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Additionally,  Boeing’s  calculations  of  failure  rate  and  exposure  time  indicated  that  the 
quantitative  probability  of  such  a  catastrophic  rate  jam  was  7.02  x  10"'°. 

The  certification  fault  tree  analysis  provided  by  Boeing  to  the  FAA  indicated  that 
the  possibility  of  an  engine  out  during  takeoff  and  a  jammed  servo  valve  were  considered. 
However,  Boeing  indicated  that  the  exposure  time  for  this  potential  scenario  was 
7  seconds  “during  takeoff  from  Vj  through  liftoff  where  the  lateral  controls  can  be  used  to 
help  control  the  engine  out.”  The  fault  tree  analysis  assumed  that  “there  is  always 
adequate  lateral  control  to  overpower  a  rudder  hardover  when  the  rudder  pressure  limiter 
is  operational.”  The  analysis  also  assumed  that  “under  normal  circumstances  flight  crew 
members,  ground  crew  members  and  maintenance  personnel  will  perform  their  routine 
tasks  without  errors  or  omission.  Additionally,  under  anticipated  normal  circumstances, 
flight  crew  members  will  perform  their  non-normal  procedures  and  basic  airmanship  per 
their  training.” 

In  its  November  24,  1998,  letter  to  the  Safety  Board,  the  FAA  stated  that,  in 
response  to  Boeing’s  October  1997  presentations,  it  agreed  that  Section  25.671  allowed 
the  type  of  qualitative  analysis  proposed  by  Boeing  and  that,  based  on  the  Boeing  747 
precedent,  the  use  of  such  analysis  was  appropriate  to  demonstrate  compliance  with  the 
rule.  However,  the  FAA  requested  that  Boeing  show  that  it  had  evaluated  the  design  of  the 
737-NG  flight  control  system  with  regard  to  critical  jam  conditions,  considered  postulated 
jams,  and  determined  that  they  were  extremely  improbable. 

On  November  1,  1997,  a  group  of  Boeing  engineers,  including  four  Designated 
Engineering  Representatives  (DER)  performed  an  inspection  of  the  737-NG  elevator 
control  system  for  position  jams  and  the  rudder  system  for  rate  jams.  Boeing  provided  the 
FAA  with  the  documentation  of  these  inspections  and  FAA  Form  8110-3,  Statement  of 
Compliance  with  the  Federal  Aviation  Regulations  (FAR),  in  which  the  DERs  requested  a 
finding  of  compliance  with  Section  25.671  (c)(3).  The  form  indicated  that  the  DERs 
performed  an  inspection  of  the  elevator,  rudder,  main  rudder  PCU  and  associated  input 
and  feedback  linkages,  and  the  standby  rudder  PCU  and  associated  input  and  feedback 
linkages.  The  form  stated  that  “the  inspections  identified  eight  areas  of  interest  with  regard 
to  jam  potential  [one  of  which  pertained  to  the  rudder].  Each  jam  area  was  analyzed  or 
tested  by  the  DERs  and  design  specialists.  For  each  jam  case,  it  was  concluded  that  either 
the  jam  could  not  occur  or  sufficient  control  movement  would  be  available  for  continued 
safe  flight  and  landing.” 

In  supplemental  data  provided  to  the  FAA  to  support  the  requested  finding  of 
compliance  with  Section  25.671(c)(3),  Boeing  indicated  that  the  DERs  concluded  that  the 
“rudder  PCUs  are  not  susceptible  to  jams  that  cause  uncommanded  motion”  and  that  the 
“service  history  shows  that  there  have  been  NO  events  or  PCU  rate  jams  in  flight  on 
Boeing  models.”  Boeing  concluded  that  “(1)  rudder  position  jams  are  controllable  when 
the  jam  occurs  within  a  normally  encountered  position  and  (2)  Rudder  PCU  rate  jams  are 
extremely  improbable  as  supported  by  analysis,  test,  and  service  history.” 
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Boeing  listed  rudder  system  design  features  of  the  737-NG  series  that  preclude 
jamming,  including  the  following: 

•  Dual  concentric  control  valves  allow  continued  control  if  either  valve  jams 
(rate  jam) — designed  for  jam  tolerance. 

•  Internal  summing  levers  are  bussed  together  to  increase  stiffness  (for  chip 
shearing  capability) — designed  for  jam  tolerance. 

•  The  input  stops  are  oriented  to  prevent  exposure  to  jams — designed  for  jam 
avoidance. 

In  its  November  24,  1998,  letter  to  the  Safety  Board,  the  FAA  stated  that  Boeing 
provided  data  that  showed  the  ability  of  the  737-NG  to  land  safely  with  the  rudder  jammed 
at  2.5°  of  deflection  (defined  by  the  FAA’s  issue  paper  F-2  as  the  maximum  normally 
encountered  control  position).  The  FAA  further  stated  that  with  the  incorporation  of  the 
hydraulic  pressure  limiter,  rate  jams  (rudder  hardovers)  were  found  to  be  controllable 
throughout  the  flight  envelope  except  for  a  short  period  of  time  during  takeoff  and 
landing,  which  the  FAA  identified  as  being  about  2  minutes.  According  to  the  FAA, 
Boeing  showed  that  a  rate  jam  during  this  exposure  time  is  extremely  improbable.  In 
addition,  the  FAA  stated  that  some  detailed  design  features  of  the  rudder  control  system 
aid  in  jam  protection,  including  the  following: 

•  controlled  clearances  between  bearing  races  and  interfacing  surfaces  so  that  a 
bearing  jam  does  not  seize  a  rotating  joint  or  shaft, 

•  a  controlled  clearance  between  internal  summing  linkages  and  the  PCU 
manifold  that  is  much  larger  than  possible  debris  particles, 

•  increased  servo  valve  chip  shear  capability, 

•  PCUs  installed  in  a  sealed  compartment  that  is  rarely  accessed  and  only  for 
maintenance, 

•  before  each  takeoff,  a  system  functional  check  or  operational  check  by  a 
maintenance  crew  to  ensure  no  anomalies  after  rudder  system  maintenance, 
and 

•  a  rudder  system  freedom-of-control  check  by  the  flight  crew  before  each 
takeoff  to  ensure  that  no  anomalies  are  present. 

The  FAA  stated  in  its  November  24,  1998,  letter  that,  after  reviewing  the  data 
provided  by  Boeing  and  all  known  jams  on  727,  737,  and  747  airplanes,  it  determined  that 
the  design  changes  made  for  the  737-600,  -700,  and  -800  rudder  system  would  prevent 
similar  jams  from  occurring  or  would  allow  alleviation  of  such  jams.  The  FAA  also 
indicated  that  it  was  able  to  find  compliance  with  Section  25.671  for  the  737-NG  series 
airplanes  based  on  the  certification  of  the  747,  the  DER  evaluation,  flight  tests,  and 
simulator  tests  that  showed  that  jam  overrides  are  acceptable  to  overcome  jams  and  that 
the  override  system  operates  correctly  when  installed. 
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1.18.4  Critical  Design  Review  Team  737  Certification  Information 
and  Recommendations 

Because  the  USAir  flight  427  accident  and  other  737  accidents  raised  questions 
regarding  the  737’s  flight  control  systems,  the  FAA  stated  that,  on  October  20,  1994,  its 
Transport  Airplane  Directorate  began  a  Critical  Design  Review  (CDR)  of  the  737  flight 
control  systems  with  emphasis  on  the  roll  control  and  directional  flight  control  systems. 
The  CDR  was  conducted  by  a  team  of  seven  flight  control  systems  specialists  from  the 
FAA,  Transport  Canada  (the  Canadian  airworthiness  authority),  and  the  USAF.^^^ 
According  to  the  CDR  team’s  report,^^’  the  team’s  specific  objectives  were  to 

•  identify  those  failure  events,  both  single  and  multiple,  within  certain  flight 
control  systems  that  result  in  an  uncommanded  deflection  or  jam  of  a  flight 
control  surface; 

•  identify  latent  failures  in  each  axis  of  flight  control; 

•  review  the  service  history  of  the  failed  or  malfunctioning  component  or 
subsystem  through  a  review  of  ADs,  SBs,  SLs,  Service  Difficulty  Reports, 
Safety  Board  recommendations,  NASA  Aviation  Safety  Reporting  System 
(ASRS)  reports,  and  other  reports; 

•  identify  and  review  the  maintenance  or  inspection  requirements  (task  and 
inspection  interval),  as  provided  by  the  manufacturer’s  Maintenance  Planning 
Document,  Maintenance  Review  Board  report,  or  MM  for  each  identified 
component  or  subsystem  with  critical  failure  potential. 

The  CDR  reviewed  the  certification  basis  and  compliance  of  the  737-100  and  -200 
and  737-300,  -400,  and  -500  series  airplanes.  The  CDR  team  noted  that  the  results  of  the 
analyses  and  tests  conducted  by  Boeing  during  certification  of  the  737-100  and  -200  and 
737-300,  -400,  and  -500  series  airplanes  showed  compliance  with  the  applicable 
certification  regulations.  Flowever,  the  CDR  noted  the  ambiguity  of  some  of  the 
terminology  used  in  14  CFR  Section  25.671  (although  that  section  was  not  part  of  the 
certification  basis  of  the  -100  through  -500  series  737s);  specifically,  the  CDR  questioned 
the  usage  of  the  terms  “normal  flight  envelope”  and  “normally  encountered.”  The  CDR 
team’s  report  indicated  that  it  did 

“not  agree  with  the  rationale  that  only  control  positions  associated  with 

‘normally  encountered’  should  be  considered.  There  are  too  many 


The  CDR  team  also  involved  one  Safety  Board  observer.  Five  of  the  seven  flight  control  specialists 
were  employed  by  the  FAA  in  the  following  capacities:  aviation  safety  inspector,  aircraft  certification 
engineer,  flight  test  pilot,  aerospace  mechanical  systems  engineer,  and  project  engineer.  Another  specialist 
was  employed  by  Transport  Canada  as  an  Airworthiness  Inspector,  and  the  other  specialist  was  a  Chief 
Master  Sergeant  in  the  Colorado  Air  National  Guard.  Each  of  the  seven  specialists  had  expertise  in  737 
certification,  737  operations,  systems  and/or  maintenance,  flight  control  and  hydraulic  systems  design/ 
specifications,  or  latent  failures. 

The  CDR  team’s  report,  entitled  “B-737  Flight  Control  System  Critical  Design  Review,”  was  issued 
May  3, 1995. 
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variables  (atmospheric  conditions,  pilot  technique,  airplane  condition  [trim 
requirement],  air  traffic,  etc.)  to  define  ‘normally  encountered’  other  than 
that  it  may  be  less  than  full  deflection.  The  Team’s  position  is  that  if  a 
control  position  is  possible,  it  is  there  for  a  purpose,  and  the  pilot  can  use 
that  control  authority.” 

The  CDR  team’s  report  further  stated  that  it  believed  “the  interpretations  that  have 
been  applied  in  the  past,  regarding  amount  of  flight  control  input  to  be  considered  in 
showing  compliance  with  the  referenced  regulations,  may  not  be  sufficient.”  Therefore, 
the  CDR  team  reviewed  failures,  combinations  of  failures,  and  malfunctions  without 
regard  to  their  probability  of  occurrence. 

The  CDR  team’s  report  also  cited  an  FA  A  issue  paper  developed  during  the 
certification  of  the  737-300  that  addressed  maintenance  items  resulting  from  certification 
activities.  According  to  the  report,  the  FAA  determined  that  it  was  not  necessary  to 
establish  a  maintenance  interval  to  show  compliance  with  certification  requirements. 
However,  the  report  stated  that  the  CDR  team  had  “identified  a  number  of  latent  failures 
that  require  some  maintenance/flightcrew  action  to  ensure  that  a  latent  failure,  combined 
with  any  subsequent  failure,  is  not  hazardous....  The  Team  believes  that  inspection  tasks 
and  intervals  should  be  established  for  vital  components  whose  latent  failure  could  have 
hazardous  consequences,  even  though  a  failure  analysis  has  shown  a  numerical  probability 
of  failure  that  allows  the  component  to  go  uninspected  for  the  life  of  the  airplane  or  until 
an  ‘on-condition’  overhaul.” 

According  to  the  CDR  report,  the  team  also  had  general  concerns  regarding  the 
design  of  the  737  aileron  and  rudder  PCUs  and  specifically  cited  the  use  of  the  dual 
concentric  servo  valves  and  the  potential  for  jamming  as  a  latent  condition  of  the  PCU. 
According  to  the  CDR  team’s  report,  “...when  considering  some  undetected  (latent) 
failures... in  the  directional  control  system,  in  combination  with  some  of  the  single 
failures... the  potential  for  a  sustained  jam  of  the  rudder  at  full  deflection,  as  limited  by 
blowdown,  is  increased.  Since  full  rudder  hardovers  and/or  jams  are  possible,  the  alternate 
means  for  control,  the  lateral  control  system,  must  be  fully  available  and  powerful  enough 
to  rapidly  counter  the  rudder  and  prevent  entrance  into  a  hazardous  flight  condition.” 

The  CDR  team’s  report  included  the  results  of  a  series  of  simulator  exercises  in 
Boeing’s  M-CAB  simulator  (configured  as  a  737-300)  that  the  team  conducted  on 
November  17, 1994.  The  purpose  of  these  exercises  was  to  determine  the  degree  of  hazard 
associated  with  certain  control  system  malfunctions,  including  a  rudder  hardover.  The 
rudder  hardover  was  simulated  by  the  PNF  applying  full  rudder  pressure  to  one  pedal  as 
rapidly  as  possible  and  holding  the  rudder  pedal  to  the  floor.  This  pressure  resulted  in 
rudder  deflection  rates  of  about  40°  per  second  (the  rudder  system  is  capable  of  deflecting 
the  rudder  at  a  rate  of  66°  per  second  under  no  aerodynamic  load).  According  to  the  CDR 
team’s  report,  tests  evaluating  “lateral  [roll]  versus  directional  control  power”  during  a 
rudder  hardover 

...basically  confirmed  Boeing’s  contention  that  lateral  [roll]  control  has 
more  roll  authority  than  does  the  dihedral  effect  from  full  rudder  inputs  for 
flight  conditions  tested  except  the  flaps  1,  190  KIAS  [knots  indicated 
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airspeed]  condition.  For  this  condition  lateral  [roll]  control  also 
predominated,  but  recovery  from  a  rudder  “hardover”  was  slow  and 
required  precise  pilot  control  of  resulting  pitch/airspeed.  Prompt  pilot 
response  was  required  to  prevent  entering  the  inverted  flight  regime  at  high 
altitude/speed. 

The  team’s  report  stated,  “as  qualified  by  Boeing,  the  rudder  PCU  dual  concentric 
valve... was  intended  to  prevent  unacceptable  rudder  deflection  after  a  single  slide 
jam.... The  dual  concentric  arrangement  does  play  a  vital  part  in  maintaining  flight 
safety... .the  crew  should  be  assured  that  they  have  a  properly  operating  valve  assembly.” 
The  CDR  team’s  report  further  stated  the  following: 

There  is  no  adequate  means  for  testing  the  dual  spool  servo  valve  for 
proper  operation  on  the  airplane. 

The  dual  spool  servo  valve  is  a  complex  assembly  and  is  a  critical 
component  of  the  rudder  and  aileron  power  control  units  and,  therefore, 
critical  to  flight  safety.  Any  facility  authorized  by  the  FAA  to  perform 
repair  and  maintenance  or  manufacture  this  component  must  assure  the 
FAA  of  having  the  necessary  equipment,  personnel  and  data  (design, 
manufacture,  qualification  and  acceptance  test  procedures),  including 
access  to  the  latest  revisions  to  the  data  provided  by  the  [original 
equipment  manufacturer]. 

The  CDR  team’s  report  made  27  recommendations  to  the  FAA  regarding  737 
certification  issues,  including  the  following: 

Develop  national  policy  and  or  rule  making  as  necessary  and  applicable  to 
transport  category  airplanes  that  define  “normal,”  with  respect  to  jams. 

This  definition  should  include  consideration  of  a  jam  of  a  control  surface  at 
any  position  up  to  its  full  deflection  as  limited  by  design 

Develop  national  policy  requiring  that,  when  alternate  means  for  flying  an 
airplane  are  employed,  those  means  shall  not  require  exceptional  pilot  skill 
and  strength  and  that  the  pilot  can  endure  the  forces  for  a  sufficient  period 
of  time  to  ensure  a  safe  landing 

Develop  national  policy  for  transport  category  airplanes  requiring  the 
determination  of  critical  hydraulic  flight  control  system  and  component 
sensitivity  (jam  potential  and  actuator  performance)  to  contamination, 
requirements  for  sampling  hydraulic  fluid,  and  requirements  for  actuator 
components  to  eliminate  or  pass  (shear)  particulate  contamination. 

Require  failure  analysis  of  the  B-737  yaw  damper  identified  components 
and  any  relevant  tests  be  conducted  to  identify  all  failure  modes, 
malfunctions  and  potential  jam  conditions  of  these  vital  elements. 

Require  corrective  action(s)  for  those  failure  modes  or  malfunctions  not 
shown  to  be  extremely  improbable. 

Require  appropriate  action  be  taken  to  reduce  the  number  of  B-737  yaw 
damper  failure  occurrences  to  an  acceptable  level. 
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Require  appropriate  action  be  taken  to  correct  the  referenced  galling 
condition  of  the  standby  rudder  on  the  B-737. 

Revise  B-737  flightcrew  training  programs  to  ensure  the  use  of  the  proper 
procedures  for  recovery  from  flight  path  upsets  and  flightcrew  awareness 
regarding  the  loss  of  aiiplane  performance  due  to  a  flight  control  system 
malfunction.  Consideration  should  be  given  to  flightcrew  action  items  as  a 
consequence  of  the  failure  analysis  developed  for  the  relevant  flight  control 
system  and  the  failure  conditions/malfunctions  examined.... 

Request  the  NTSB  form  a  special  accident  investigation  team  to  begin  a 
new  combined  investigation  of  both  the  B-737  Colorado  Springs  and  the 
Pittsburgh  accidents. 

In  an  August  27,  1998,  letter  to  the  Safety  Board,  the  FAA  described  its  actions  in 
response  to  the  CDR  team’s  recommendations.  The  FAA,  among  other  things,  referred 
several  of  the  regulatory  and  policy  issues  raised  by  the  CDR  team’s  recommendations 
(including  the  definition  of  normally  encountered)  to  an  Aviation  Rulemaking  Advisory 
Committee;  referred  the  issue  of  hydraulic  fluid  contamination  to  the  Society  of 
Automotive  Engineers  (SAE)  A-6  Committee — Aerospace  Fluid  Power,  Actuation,  and 
Control  Technologies — which  made  recommendations  on  contamination  limits;  and 
issued  several  ADs  to  address  operational  and  maintenance  issues.  (A  complete  list  of  the 
recommendations  made  by  the  CDR  team  and  the  FAA’s  follow-up  actions  in  response  to 
those  recommendations  are  contained  in  appendix  D.) 

Also  in  response  to  the  CDR  team’s  recommendations,  the  Safety  Board  convened 
an  independent  technical  panel  of  consultants  (see  section  1.18.2)  and  combined  the 
investigation  of  USAir  flight  427  with  the  investigation  of  United  flight  585  (see  section 
1.16.1.1). 

1.18.5  Boeing  737  Rudder  System  Design  Improvements 

As  a  result  of  the  rudder  reversal  mechanism  that  became  apparent  during  the 
investigation  of  the  July  16,  1992,  United  Airlines  ground  check  incident  (see  section 
1.18.1.1),  the  Safety  Board  issued  Safety  Recommendation  A-92-120,  asking  the  FAA  to 
issue  an  AD  to  require  737  operators  to  incorporate  design  changes  for  the  main  rudder 
PCU  servo  valves  that  would  preclude  the  possibility  of  rudder  reversals  attributed  to 
overtravel  of  the  secondary  slide.^^*  In  response  to  this  recommendation,  the  FAA  issued 
AD  94-01-07,  effective  March  3,  1994.  The  AD  required  a  leak  test  of  the  737  main 
rudder  PCU  in  accordance  with  Boeing  SL  737-SL-27-82-B.  The  leak  test  involved 
inputting  full  rapid  rate  rudder  commands  and  monitoring  the  hydraulic  system  flow 
demand  to  detect  signs  of  internal  leakage,  which  would  indicate  that  the  secondary  slide 
was  extending  beyond  its  design  limits.  The  AD  required  the  leak  test  to  be  repeated  at 
750-flight  hour  intervals  until  the  main  rudder  PCU  was  replaced  with  a  unit  designed  to 
preclude  overtravel  of  the  secondary  slide  and  included  improved  control  of  dimensional 


As  previously  discussed,  overtravel  is  the  axial  movement  of  the  servo  valve  slides  beyond  the 
intended  design  limit. 
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tolerances  and  part  matching.  The  AD  required  replacement  of  the  main  rudder  PCUs 
within  5  years  of  the  AD’s  effective  date.  The  redesign  of  the  servo  valve  was  approved  by 
the  FAA  by  the  time  that  AD  94-01-07  became  effective. 

The  FAA  also  issued  AD  96-23-51,  effective  November  27,  1996.  The  AD 
required  that  all  737  airplanes  be  inspected  within  10  days  and  tested  in  accordance  with 
Boeing  SB  737-27A1202  every  250  flight  hours  thereafter  until  the  main  rudder  PCU  was 
replaced  with  one  that  incorporated  the  redesigned  servo  valve.  Boeing’s  SB  and  the 
FAA’s  AD  required  that  the  rudder  pedals  be  exercised  to  determine  if  a  secondary  slide 
jam  to  the  servo  valve  housing  had  previously  occurred  but  had  not  been  detected. 

Further,  the  FAA  issued  AD  97-14-04,  which  became  effective  on  August  4,  1997, 
and  superceded  the  servo  valve  replacement  requirement  of  AD  94-01-07.  The  new  AD 
required,  within  2  years  of  its  effective  date,  that  the  main  rudder  PCUs  on  all  737-100 
through  -500  series  airplanes  be  replaced  with  units  containing  a  redesigned  servo 
valve.^^^  AD  97-14-04  also  required  the  replacement  of  outer  bolts  on  737  main  rudder 
PCU  input  rods.  This  requirement  was  mandated  because  fractured  outer  bolts  had  been 
discovered  on  two  occasions  during  normal  maintenance  activities.  In  each  case,  the 
fracture  was  found  to  have  initiated  when  the  nut  was  sufficiently  tightened  to  cause  the 
nut  threads  to  contact  the  shank  of  the  bolt.  The  bolts  are  used  in  a  dual  load  path  design 
with  inner  and  outer  elements,  either  of  which  is  sufficient  to  retain  the  input  rod. 
However,  if  the  redundant  load  path  is  compromised  and  fails,  a  fully  deflected  rudder  is 
possible;  therefore,  a  new  bolt  was  designed  to  prevent  the  shank  from  contacting  the  nut 
threads.  These  bolts  are  to  be  replaced  when  the  main  rudder  PCUs  are  removed  to 
incorporate  the  redesigned  servo  valve. 

After  Safety  Board  testing  in  1996  showed  that  the  servo  valve  primary  slide  could 
overtravel  (move  past  its  intended  position)  if  the  secondary  slide  jammed  to  the  housing, 
Parker  redesigned  the  servo  valve  again.  The  redesign,  which  was  completed  in  1998, 
lengthened  the  primary  and  secondary  slides  about  0.5  inch,  modified  the  servo  valve  end 
cap,  and  moved  the  flow  port  pathways  and  metering  edges  farther  apart  so  that,  if  the 
secondary  slide  were  to  jam  to  the  servo  valve  housing,  overtravel  of  the  primary  slide 
would  not  connect  ports  that  could  cause  reverse  operation.  All  737-NG  series  airplanes 
(the  -600,  through  -900  series)  are  being  produced  with  the  newly  redesigned  servo  valve. 

The  original  servo  valve  design  incorporated  small  washer-like  “inserts”  that  had 
fluid  passages  cut  into  them.  These  inserts  (made  of  52100  steel)  were  installed  in  the 
inner  diameter  of  the  housing  and  secondary  slide  (made  of  surface-hardened  Nitralloy) 
and  formed  the  passages  for  hydraulic  fluid  flow  through  the  valve.  In  the  1998  redesigned 
servo  valve,  the  inserts  were  replaced  with  a  one-piece  design  (made  of  52100  steel)  that 
provides  the  same  function  and  reduces  the  number  of  parts  required.  The  redesign  of  the 
inserts  to  the  single-piece  configuration  was  made  possible  by  advances  in  manufacturing 
technology  that  allows  the  small  fluid  passages  to  be  Electro  Discharge  Machined  into  the 


According  to  Boeing,  as  of  September  1998  there  were  2,776  in-service  737s  in  the  -100  through 
-500  series  and  3,187  in-service  PCUs  (accounting  for  serviceable  spares  not  installed  on  in-service 
airplanes). 
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single  piece  rather  than  built  up  by  a  group  of  smaller  parts.  Figure  31  shows  the  1998 
redesigned  servo  valve  for  both  the  earlier  737  series  airplanes  and  the  737-NG  airplanes. 


737-  NG  Valve 


Figure  31.  Parker’s  1998  redesigned  servo  valve  for  737  airplanes. 

In  addition,  the  FAA  issued  AD  97-14-03,  which  requires  a  redesigned  yaw 
damper  system  on  all  737-100  through  -500  series  airplanes  by  August  1,  2000.  The 
redesigned  system  is  to  replace  the  current  yaw  damper  coupler  with  a  single 
electromechanical  rate  gyro  that  includes  an  improved  coupler  with  a  dual  solid-state  rate 
sensor.  The  system  is  also  to  provide  improved  system  monitoring  and  fault  analysis 
through  improvements  in  built-in  test  equipment.  The  yaw  damper  system  wire  shielding 
and  isolation  are  to  eliminate  potential  electrical  interference.  All  737-NG  series  airplanes 
incorporate  the  redesigned  yaw  damper  system. 

~AD  97-14-03  also  requires  that  all  737-100  through  -500  series  airplanes  be 
modified  by  adding  a  hydraulic  pressure  reducer  to  hydraulic  system  A  near  the  rudder 
PCU  to  reduce  the  amount  of  rudder  available  to  the  flight  crew  during  those  phases  of 
flight  when  large  rudder  deflections  are  not  required.  The  reduced  rudder  authority  is  to  be 
accomplished  by  lowering  the  hydraulic  pressure  from  3,000  to  1,000  psi  (737-300,  -400, 
and  -500)  or  1,400  psi  (737-100,  and  -200  series  airplanes).  The  yaw  damper  system  is  not 
affected  by  the  hydraulic  pressure  reducer  because  that  system  operates  off  hydraulic 
system  B.  The  hydraulic  pressure  reducer  system  is  inactive  in  the  two  situations  in  which 
full  rudder  authority  may  be  required:  below  1,000  feet  agl  during  takeoff  climb  and 
below  700  feet  agl  during  landing  approach.  The  hydraulic  pressure  reducer  to  be  installed 
on  the  737-300,  -400,  and  -500  series  airplanes  also  restores  full  rudder  authority 
regardless  of  altitude  when  the  rotation  speed  of  the  two  engines  differs  by  more  than  45 
percent.  According  to  Boeing  personnel,  because  the  hydraulic  pressure  reducer  control 
and  indication  logic  are  incorporated  into  the  redesigned  yaw  damper  coupler,  the  pressure 
reducer  will  be  added  at  the  same  time  as  the  yaw  damper  system  changes. 
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All  737-NG  series  airplanes  incorporate  a  hydraulic  pressure  limiter  into  the  main 
rudder  PCU.  The  limiter  is  controlled  by  airspeed  and  limits  pressure  to  hydraulic  system 
A  inputs  of  the  PCU  by  a  bypass  valve.  The  limiter  is  commanded  to  limit  hydraulic 
pressure  as  the  airspeed  is  increased  to  greater  than  137  knots  and  resets  as  the  airspeed  is 
decreased  to  less  than  139  knots. 

1.18.5.1  Fractures  in  1998  Redesigned  Servo  Valve  Secondary  Slides 

In  August  1998,  Parker  staff  became  aware  that,  during  production  slide  testing, 
fractures  had  been  discovered  in  several  of  the  newly  redesigned  servo  valve  secondary 
slide  legs.  Subsequent  examination  of  502  servo  valves  in  Parker’s  stock  revealed  a  total 
of  9  fractured  secondary  slides;  1  fractured  secondary  slide  and  1  chipped  secondary 
slide^*”  were  subsequently  discovered  in  stock  by  Olympic  Airways  personnel.  (Another 
cracked  secondary  slide  was  also  discovered  in  a  Maersk  737  main  rudder  PCU  that  was 
removed  from  service  on  February  3,  1999,  because  of  a  malfunctioning  yaw  damper  and 
leakage.  The  crack  was  discovered  as  a  result  of  a  test  performed  at  Parker  on  February  9, 
1999,  to  detect  cracking  of  the  secondary  slide.)  According  to  Parker  and  Boeing 
personnel,  of  the  1,686  redesigned  servo  valves  that  had  been  shipped  (to  Boeing  or  the 
airlines),  about  969  had  been  installed  on  airplanes  before  the  fractured  secondary  slides 
were  discovered.  Boeing  and  Parker  personnel  stated  that  all  of  the  fractured  secondary 
slides  had  been  magnetic  particle  inspected  in  their  preassembled  form  with  no  fractures 
detected.^*' 

Safety  Board  personnel  became  aware  in  late  September  1998  of  the  fractures  in 
the  redesigned  servo  valve  secondary  slides.  The  Safety  Board’s  (visual  and  microscopic) 
examination  of  the  fractured  secondary  slides  revealed  that  the  fractures  consistently 
occurred  on  only  one  of  the  two  legs  at  the  input  side  of  the  secondary  slide.  The  fracture 
appeared  to  initiate  at  the  relatively  sharp  radius  where  the  secondary  slide  reduces  in 
cross  section  to  accommodate  the  input  mechanism  for  the  primary  and  secondary  slides, 
and  the  fracture  progressed  all  the  way  through  the  leg,  deviating  on  an  angle,  in  all  but 
one  secondary  slide.  (The  location  of  the  crack  on  the  remaining  slide  was  farther  along 
the  leg.) 

According  to  Boeing  and  Parker  personnel,  they  examined  several  known  and 
suspected  cracking  scenarios  to  determine  the  source  of  the  cracks.  These  scenarios 
included  delayed  quench  cracking,  delayed  cracking  resulting  from  transformation  of 
retained  austenite  to  martensite,  residual  tensile  stresses  (from  grit  or  bead  blasting  after 
machining),  slow  overstress,  improper  rig  pin  installation,  and  external  impact  loads. 
(External  impact  loads  were  generated  by  dropping  the  secondary  slide  from  a  height  of 
about  3  feet  onto  a  steel  plate  floor.)  According  to  Boeing  and  Parker  personnel,  the 
fractures  that  resulted  during  tests  involving  external  impact  loads  produced  a  fracture 


According  to  Boeing  personnel,  the  chipped  secondary  slide  leg  was  not  fractured  completely 
through;  both  sides  of  the  leg  exhibited  what  appeared  to  be  marks  from  a  rigging  tool,  and  Boeing  indicated 
that  the  chip  likely  resulted  from  abusive  handling  of  that  rigging  tool. 

After  the  servo  valve  components  undergo  inspection,  the  servo  valves  are  assembled,  rigged,  and 
tested  at  Parker. 
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surface  with  characteristics  similar  to  those  exhibited  by  the  10  fractured  secondary  slides. 
Boeing  personnel  stated  that,  although  the  cause  of  the  fractured  secondary  slides  has  not 
yet  been  identified,  improper  handling  would  be  the  most  likely  mechanism. 

During  a  December  3, 1998,  briefing  at  Safety  Board  headquarters  in  Washington, 
D.C.,  Boeing  personnel  stated  that  review  of  the  potential  fractured  secondary  slide  leg 
scenarios  indicated  the  following: 

•  if  only  one  leg  of  the  secondary  slide  failed,  rudder  performance  would  be 
normal; 

•  if  the  second  leg  of  the  secondary  slide  also  failed,  but  the  end  piece  remained 
in  place,  rudder  performance  would  be  normal  except  that  trailing  edge  left 
movements  would  occur  at  half  rate;  and 

•  if  the  second  leg  failed  and  the  separated  end  piece  moved  within  the  PCU 
cavity,  an  input  link  jam  off  neutral  might  occur,  resulting  in  a  rudder  hardover. 

Boeing  and  Parker  personnel  have  developed  and  are  instituting  a  modified  servo 
valve  production  plan,  which  includes  new  (postassembly)  servo  valve  dye  penetrant 
inspection  and  PCU  servo  valve  secondary  slide  displacement  tests.  Boeing  drafted  two 
alert  service  bulletins  (ASB)^^^  that  describe  procedures  for  the  PCU  servo  valve 
secondary  slide  displacement  test,  criteria  for  passing  the  test,  and  procedures  for 
replacement  of  any  discrepant  servo  valve  assembly  with  one  having  a  secondary  slide 
that  passed  the  displacement  test. 

During  the  December  1998  briefing,  Boeing  personnel  also  prioritized  the 
fractured  secondary  slide  problem,  asking  “what’s  more  important:  crack  fix  or  reversal 
fix?”  Boeing’s  proposal  indicated  that  its  analysis  showed  that  continued  use  of  the  current 
servo  valve  would  be  preferred  over  the  1998  redesigned  servo  valve.  The  proposal  further 
stated  that  “as  a  precaution,  Boeing  believes  correction  of  crack  issue  should  have  priority 
over  correction  of  reversal  scenario.”  Because  of  this  proposed  shift  in  priorities,  Boeing 
recommended  that  the  deadline  for  the  installation  of  redesigned  servo  valves  (required  by 
AD  97-14-04,  which  addressed  the  potential  of  a  rudder  reversal  condition)  be  extended  to 
August  2000  or  later  (instead  of  August  1999,  as  currently  required). 

On  January  13,  1999,  the  FAA  issued  a  Notice  of  Proposed  Rulemaking  (NPRM, 
Docket  No.  98-NM-383-AD),  proposing  an  AD  that  would  require  operators  to  perform 
PCU  servo  valve  secondary  slide  displacement  tests  (as  described  in  Boeing’s  draft  ASBs) 
at  regular  intervals  and  replace  the  servo  valve  assembly  if  necessary.  The  NPRM  stated 
that  because  the  proposed  AD  is  an  “interim  action  and  a  final  action  has  not  yet  been 
identified  to  adequately  address  the  identified  unsafe  condition,  it  will  be  necessary  to 
repeat  the  displacement  test  on  all  [737]  series  airplanes,  including  airplanes  that  are 
produced  subsequent  to  those  with  line  numbers  specified  in  the  draft  alert  service 
bulletins.” 


When  finalized,  ASBs  737-27A1221  and  737-27A1222  will  apply  to  737-100  through  -500  series 
aiq^lanes  and  737-NG  series  airplanes,  respectively. 
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1.18.6  Human  Performance  Considerations 

1.18.6.1  Pilot  Incapacitation 

The  Safety  Board  is  aware  of  two  instances  of  pilot  incapacitation  involving 
unintentional  rudder  inputs  during  flight.^^^  The  first  instance  occurred  on  June  11,  1980, 
and  involved  a  Frontier  Airlines  737  on  a  visual  approach  to  its  destination  airport  in 
Cheyenne,  Wyoming.  The  captain  of  this  flight  reported  that  the  first  officer  was  manually 
flying  the  airplane  and  that  he  decided  to  fly  the  approach  10  knots  faster  than  the  normal 
approach  airspeed  because  of  a  possible  windshear  encounter  during  the  approach.  The 
captain  indicated  that,  as  the  airplane  descended  through  about  800  feet  agl,  he  observed 
the  airspeed  increasing  and  commented  “we  are  too. .  .fast”  but  that  the  first  officer  did  not 
respond.  The  captain  reported  that,  when  he  called  for  a  go-around  and  reached  for  the 
throttles,  the  airplane’s  nose  yawed  to  the  left.  According  to  the  captain’s  postincident 
written  report,  “I... glanced  at  the  First  Officer  and  realized  that  he  was  incapacitated  and 
apparently  unconscious.  1  added  full  power  and  began  a  climb  and  missed  approach.  The 
aircraft  was  still  wallowing  around  and  I  was  having  a  problem  getting  the  controls  into  a 
coordinated  flight  situation.  The  airplane  flew  best  in  a  climbing  left  turn.” 

The  captain  stated  that  he  instructed  a  flight  attendant  to  put  an  oxygen  mask  on 
the  first  officer.  The  flight  attendant  advised  the  captain  that  the  first  officer’s  left  leg  was 
rigid  and  was  pushing  against  the  left  rudder  pedal.  The  flight  attendant  moved  the  first 
officer’s  leg  off  the  rudder,  and  the  captain  regained  normal  control  of  the  airplane.  The 
captain  stated  that  he  returned  to  land  without  further  incident,  and  the  first  officer  began 
to  revive  as  the  airplane  taxied  to  the  terminal.  (The  article  in  Flying  magazine  indicated 
that  the  first  officer’s  incapacitation/seizure  was  the  result  of  a  chemical  imbalance,  which 
was  subsequently  treated  successfully.) 

During  postincident  interviews  with  Safety  Board  personnel,  the  captain  reported 
that  he  was  “startled”  at  the  beginning  of  the  incident;  he  stated  that  he  flew  reflexively 
and  that  his  motor  responses  were  sharp  and  unaffected  by  the  sudden  change  of  events. 
However,  the  captain  stated  that,  until  the  flight  attendant  observed  that  the  first  officer 
was  depressing  the  left  rudder  pedal,  he  did  not  know  what  was  causing  the  airplane  to 
yaw  to  the  left.  The  captain  reported  that  he  was  surprised  that  he  was  not  aware  that  the 
left  rudder  pedal  was  pushed  forward. 

The  second  instance  of  pilot  incapacitation  involving  unintentional  rudder  inputs 
occurred  on  March  29,  1994,  and  involved  a  Southwest  Airlines  737  on  approach  to  its 
destination  airport  in  Oakland,  California.  During  postincident  interviews  with  Safety 
Board  personnel,  the  captain  of  the  Southwest  Airlines  flight  stated  that  the  first  officer 


The  Safety  Board  became  aware  of  the  first  incident  when  a  staff  member  read  an  account  of  the 
event  in  the  January  1996  issue  of  Flying  magazine.  The  captain  of  the  Frontier  Airlines  flight  told  Safety 
Board  investigators  that  he  decided  to  write  the  article  after  the  United  Airlines  flight  585  accident  in  March 
1991  and  that  the  article  was  accepted  for  publication  in  July  1994.  After  learning  about  this  incident.  Safety 
Board  staff  asked  the  FAAs  CAMI  to  search  the  Pilot  Incapacitation  Database  for  similar  incidents.  This 
search  revealed  a  second  incident,  involving  a  Southwest  Airlines  737. 
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was  performing  PF  duties  during  the  approach  with  the  autopilot  engaged  in  CWS  mode. 
The  captain  stated  that  the  airplane  was  in  clouds  and  fog,  about  1,500  feet  agl,  when  the 
first  officer  “let  out  a  blood  curdling  scream.”  The  captain  reported  that  the  first  officer 
was  staring  out  the  forward  cockpit  window,  his  eyes  were  extremely  large,  and  his  back 
was  arched.  (These  observations  led  the  captain  to  wonder  at  first  whether  the  first  officer 
might  have  been  shocked  by  the  circuit  breakers  located  behind  his  seat). 

The  captain  reported  that,  seconds  later,  the  first  officer  screamed  another  time,  his 
back  went  rigid,  and  he  clutched  at  the  control  column.  The  captain  noticed  that  the 
airplane  began  to  roll  right  and  felt  the  left  rudder  pedal  hit  his  ankle.  The  captain  stated 
that,  when  he  placed  his  feet  on  the  rudder  pedals,  he  noted  the  left  rudder  pedal  was 
displaced  aft  about  5  to  6  inches.  The  captain  reported  that  he  disconnected  the  autopilot, 
applied  aileron  in  the  direction  opposite  the  roll,  and  physically  struggled  (against  the 
rudder  pressure  applied  by  the  first  officer)  to  neutralize  the  rudder  pedal  position.  The 
captain  stated  that  he  also  tried  to  use  differential  engine  thrust  to  counter  the  effects  of  the 
rudder  pressure.  When  a  flight  attendant  unlatched  the  first  officer’s  lap  belt  and  shoulder 
harness,  the  pressure  on  the  rudder  pedals  was  released,  and  the  captain  landed  the 
airplane  without  further  incident.  The  captain  stated  that  he  was  startled  at  the  beginning 
of  the  incident,  which  delayed  his  action  by  no  more  than  2  to  3  seconds.  The  captain  also 
stated  that  he  later  learned  that  the  first  officer  had  suffered  a  seizure  and  had  no 
recollection  of  the  incident. 

1.18.6.2  Spatial  Disorientation 

According  to  a  book  on  flightdeck  performance,^^'*  spatial  disorientation  (a  loss  of 
correct  perception  of  one’s  orientation  with  respect  to  the  ground — typically  from  a 
conflict  between  vestibular  cues  and  those  of  visual  and  kinesthetic  cues)  can  contribute  to 
incorrect  pilot  control  inputs.  The  book  states  that  a  pilot  uses  information  from  vestibular 
(inner  ear)  and  visual  (internal — flight  instrumentation,  external — horizon)  cues  to 
determine  the  airplane’s  position  in  space,  making  disorientation  more  likely  when  fewer 
cues  exist.  The  book  further  states  that  spatial  disorientation  is  unlikely  when  strong 
external  visual  cues  exist;  however,  abrupt,  rapid  aircraft  movements  and  accelerations 
can  lead  to  spatial  disorientation  if  combined  with  a  loss  of  external  visual  references  (or 
the  presence  of  misleading  external  visual  references). 

At  the  request  of  the  Safety  Board,  a  research  scientist  from  NASA’s  Ames 
Research  Center,  who  is  an  experimental  psychologist  specializing  in  human  spatial 
orientation,  reviewed  the  FDR  information,  the  CVR  transcript,  and  a  description  of  the 
USAir  flight  427  accident  circumstances.  The  research  scientist  was  also  involved  in  the 
Safety  Board’s  wake  encounter  simulations  in  NASA-Ames’  VMS  simulator  (see  section 
1.16.3),  which  attempted  to  represent  the  conditions  and  forces  experienced  by  the  pilots 
of  flight  427. 


Roscoe,  S.,  and  O’Hare,  D.  1990.  Flightdeck  Performance;  The  Human  Factor.  Ames,  Iowa:  Iowa 
State  University  Press,  chapter  2. 
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During  the  series  of  wake  encounter  simulations,  the  NASA  research  scientist 
occupied  either  the  right  or  left  seat  of  the  simulator,  with  a  Safety  Board,  ALFA,  USAir, 
or  Boeing  official  occupying  the  other  seat.^*^^  The  research  scientist  stated  that  the 
simulator  was  programmed  so  that  he  received  motion  cues  alone  (without  any  visual 
display)  during  several  of  the  simulations  and  motion  cues  combined  with  simulated,  but 
representative,  external  visual  cues  during  other  simulations.  At  one  of  the  public  hearing 
sessions  related  to  the  USAir  flight  427  investigation,  the  research  scientist  described  his 
impressions  of  the  wake  turbulence  encounter  (the  initial  portion  of  flight  427’s  upset 
event)  as  follows: 

...I  was  surprised  at  how  gentle  it  all  was.  I  had  thought  that  the  upset 
would  be  more  severe.  It  was  a  surprise,  it  did  get  my  attention.  But  it  was 
not  a  violent  kind  of  an  upset  that  would... have  me  fail  to  know  where  I 
was  and  what  my  orientation  was. ... 

The  research  scientist  strongly  believed  that  the  simulator  pilots  were  not  spatially 
disoriented  during  the  initial  upset  event  because  clear  external  visual  cues  (the  sky, 
ground,  and  horizon  cues  provided  by  the  VMS  visual  simulation)  were  available 
throughout  the  simulation  and  the  motions  of  the  simulator  were  gradual  and  not 
excessively  violent.  The  scientist  further  stated  that,  during  postsimulator  ride  interviews, 
the  simulation  pilots  reported  that  they  always  knew  the  location  and  orientation  of  the 
airplane  in  relation  to  the  ground  and  that  they  could  have  flown  out  of  the  wake 
turbulence  portion  of  the  upset  event.^^^ 

With  regard  to  the  accident  flight,  the  research  scientist  stated: 

I  believe  that  the  pilots  probably  would  have  experienced  little  difficulty  in 
maintaining  an  accurate  perception  of  their  orientation,  even  during  any 
brief  periods  when  they  may  have  lost  sight  of  the  visual  horizon  due  to  the 
pitch  down  attitude  of  the  airplane.  In  addition,  perturbations  of  the  flight 
path  generally  appear  to  have  been  followed  by  verbal  comments  from  the 
pilots,  indicating  that  they  were  fully  aware  of  their  trajectory,  and  that  they 
were  not  able  to  change  it... it  does  not  appear  at  all  likely  that  pilot 
disorientation  due  to  abnormal  vestibular  stimulation  provided  a  major 
contribution  to  this  accident. 

1.18.7  Wake  Turbulence/Upset  Event  Information 

1 .1 8.7.1  Previous  Wake  Turbulence  Accidents 

The  Safety  Board’s  Aviation  Accident  Database  (which  contains  information 
regarding  aviation  accidents  that  occurred  in  the  United  States  since  1962)  revealed  three 
air  carrier  accidents  in  which  wake  turbulence  encounters  were  determined  to  be  causal 


The  individuals  who  participated  in  these  simulator  sessions  were  passengers  in  the  simulator  and 
did  not  manipulate  the  simulator’s  flight  controls. 

As  previously  discussed,  although  the  VMS  is  better  able  to  represent  airplane  motions  than  most 
simulators,  even  VMS  motions  do  not  realistically  represent  some  airplane  motions  and  accelerations 
(lateral  and  vertical). 
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factors  in  the  accident.  All  three  accidents  occurred  when  the  airplanes  were  at  a  low 
altitude  in  the  vicinity  of  airports. 

•  On  March  8, 1964,  a  Douglas  DC-3  crashed  while  landing  at  Chicago,  Illinois. 
According  to  the  accident  report,  the  airplane  was  following  a  Boeing  707  jet 
aircraft.  The  probable  cause  of  the  accident  was  “the  failure  of  the  crew  to 
utilize  available  de-icing  equipment  and  engine  power  to  maintain  positive 
control  of  the  aircraft  under  conditions  of  rapid  airframe  ice  accretion  and 
vortex  induced  turbulence.” 

•  On  July  15,  1969,  a  deHavilland  DHC-6  crashed  while  taking  off  at  Jamaica, 

New  York,  behind  a  “recently  departed  jet.”  All  other  material  regarding  this 

accident  was  destroyed  in  1984  (15  years  after  the  accident). 

•  On  May  30, 1972,  a  Douglas  DC-9  crashed  while  landing  at  Fort  Worth,  Texas, 
behind  a  DC- 10.  The  DC-9  was  being  operated  in  the  airport  traffic  pattern 
under  VFR,  which  places  the  responsibility  for  ensuring  adequate  air  traffic 
separation  on  the  pilots.  The  DC-9  was  following  53  to  54  seconds  behind  the 
preceding  DC- 10.  Although  this  accident  involved  VFR  traffic  separation,  the 
FAA  increased  ATC  IFR  separation  standards  2  months  after  the  accident; 
since  this  change,  there  have  been  no  documented  air  carrier  accidents  in 
which  wake  turbulence  encounters  were  determined  to  be  causal  factors. 
Review  of  FDR  data  from  this  accident  airplane  revealed  that,  during  the  wake 
vortex  encounter,  the  airspeed  decreased  from  about  130  to  about  60  knots  and 
then  increased  to  about  300  knots.  Further,  the  FDR-recorded  altitude  (which 
had  been  descending  consistent  with  approach  to  landing)  changed  from  about 
600  to  6,300  feet.  These  variations  are  consistent  in  direction  and  scale  with 
FDR  data  from  other  rotor  encounters. 

1.18.7.2  Aviation  Safety  Reporting  System  Reports  of  Uncommanded 
Upsets/Wake  Turbulence  Encounters 

To  support  the  Safety  Board’s  investigation  of  the  USAir  flight  427  accident, 
NASA  personnel  reviewed  the  agency’s  ASRS  pilot  report  database^’®  and  produced 
reports  in  several  subject  areas,  including  737-type  reports,  737-type  rudder  trim/control 
reports,  Pittsburgh  terminal  area  conflicts,  and  wake  turbulence  encounter/uncommanded 
upset/loss  of  control  events  in  multiengine  turbojet  aircraft.  These  reports  assisted  the 
Safety  Board  in  conducting  a  thorough  review  of  previous  yaw/roll  events  (as  discussed  in 
section  1.18.1.1.)  ASRS  personnel  also  accomplished  “structured  callback”  studies  in 


See  Civil  Aeronautics  Board.  1965.  Hansen  Air  Activities,  Douglas  DC-3A,  N410D,  near  Chicago- 
O’Hare  International  Airport,  Chicago,  Illinois,  March  8,  1964.  CAB  File  2-0002.  Washington,  DC. 

See  National  Transportation  Safety  Board.  Brief  of  Accident.  New  York  Airways,  Inc.,  deHavilland 
DHC-6,  N558MA,  at  JFK  International  Airport,  Jamaica,  New  York,  July  15,  1969.  NTSB  File  1-0020. 
Washington,  DC. 

See  National  Transportation  Safety  Board.  1973.  Delta  Air  Lines,  Inc.,  McDonnell  Douglas 
DC-9-14,  N3305L,  Greater  Southwest  International  Airport,  Fort  Worth,  Texas,  May  30,  1972.  Aircraft 
Accident  Report  NTSB/AAR-73/03.  Washington,  DC. 
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which  they  interviewed  the  pilots  who  provided  the  original  reports.  (After  preliminary 
processing,  ASRS  personnel  typically  deidentify  all  incoming  ASRS  reports  to  protect  the 
identity  of  the  reporting  individuals;  however,  the  pilots  who  were  interviewed  on  a 
voluntary  basis  as  part  of  the  structured  callback  studies  waived  that  anonymity.) 

Data  from  the  “Multi-Engine  Turbojet  Uncommanded  Upsets  Structured  Callback 
Summary”  (a  project  conducted  to  support  the  USAir  flight  427  investigation)  revealed 
that  wake  turbulence  was  the  most  common  cause  of  the  upset/loss  of  control  events 
reported  by  pilots  between  January  1987  and  May  1995,  cited  in  96  of  297  cases.  Pilots 
reported  using  rudder  during  recovery  efforts  in  one-third  (11  events)  of  the  33  upset 
events  reported  by  airline  pilots  to  ASRS  between  May  1  and  October  31,  1995  (and 
examined  in  depth  through  structured  callback  efforts).^’' 

Data  from  the  ASRS  “Wake  Turbulence  Structured  Callback  Project”  (a  project 
conducted  by  the  FAA  in  response  to  a  Safety  Board  recommendation)  revealed  that 
166  wake  turbulence  events  were  reported  between  April  1995  and  August  1997,  of  which 
101  were  from  pilots  of  multiengine  turbojet  airplanes  (including  33  from  737  pilots).^^^ 
Review  of  the  ASRS  reports  and  comments  obtained  from  the  pilots  during  followup 
interviews  revealed  that  flight  crews  were  frequently  surprised  by  the  suddenness  and 
severity  of  the  wake  turbulence  encounters.^’'*  The  pilots’  comments  included  the 
following: 

“The  severity  of  this  encounter  surprised  me....  I  could  have  very  easily 
ended  up  on  my  back,  and  this  was  from  another  737!” 

“[The  pilots]  encountered  a  violent  roll  [to  the  left]  25  [degrees]  and  then  a 
violent  roll  back  to  [the  right]  into  a  25  [degree]  bank.” 

“It  took  almost  full  aileron  input  to  keep  from  rolling  past  45  degrees.... 

The  wake  I  encountered  was  considerably  more  than  normal.” 

“During  that  time  we  experienced  very  rapid  roll  rates... rolling  45  degrees 
left  and  right,  and  full  aileron  often  required  to  keep. .  .right  side  up.” 

“[An  uncommanded  upset  that  produced  aircraft  roll  of]  at  least  45 
[degrees],”  and  that  the  “[aircraft]  felt  out  of  control,  very  mushy... didn’t 
think... could  control  the  [aircraft].” 

“We  were  rolled  into  an  approx [imately]  45-50  [degree]  bank  from  wake 
turbulence....  Such  encounters... are  highly  distracting  and  require 
immediate  attention.” 


ASRS  is  a  national  repository  for  reports  regarding  aviation  safety-related  issues  and  events.  ASRS 
reports  are  voluntarily  submitted  by  pilots,  air  traffic  controllers,  air  carrier  personnel,  and  other  aviation 
professionals  when  they  want  to  make  known  a  potentially  unsafe  condition  or  event.  The  Director  of 
NASA’s  ASRS  program  cautions  that  the  existence  of  reports  pertaining  to  any  subject  area  should  not  be 
considered  a  statistically  valid  indication  of  the  prevalence  of  that  problem  within  the  aviation  system, 
however,  the  ASRS  database  may  provide  some  indication  of  the  number  of  aviation  safety-related  events 
that  occur  in  any  given  subject  area,  and  the  reports  are  a  useful  source  of  narrative  descriptions  of  in-flight 
events. 
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The  Safety  Board’s  review  also  revealed  that,  among  pilots  of  multiengine  turbojet 
airplanes,  30  percent  reported  that  the  wake  turbulence  encounter  occurred  at  night,  and 
7  percent  reported  that  the  encounter  occurred  in  IFR  conditions.^^^  Of  the  reported 
encounters,  55  percent  occurred  at  altitudes  at  or  below  6,000  feet  msl  (the  altitude  of 
US  Air  flight  427  at  the  time  of  the  initial  upset);  18  percent  occurred  at  altitudes  at  or 
below  500  feet.  In  addition,  25  percent  of  the  pilots  reported  that  the  autopilot  remained 
engaged  during  the  turbulence  encounter.  In  all  the  cases  examined  through  the  ASRS 
reports,  the  pilot(s)  maintained  or  regained  control  of  the  airplane  and  landed  without 
further  incident. 


To  obtain  additional  data  regarding  rudder  use  during  air  carrier  operations,  the  Safety  Board 
reviewed  more  than  100  references  to  accidents  and  incidents  that  were  provided  by  Boeing  (in  its  “Human 
Factors  Supplement,  Submission  to  the  National  Transportation  Safety  Board  for  the  USAir  427 
Investigation,”  September  30,  1997),  the  Board’s  own  records  of  737  accidents  and  incidents,  and  additional 
737  incident  data  and  QAR  information  obtained  from  accident  investigation  authorities  worldwide. 
Examination  of  the  available  data  revealed  that  cross-control  conditions  (rudder  pedal  input  opposing 
control  wheel  input)  occurred  occasionally  in  response  to  an  unexpected  anomaly  or  wake  turbulence.  One 
such  event  occurred  on  October  27,  1986,  and  involved  a  Trans  Australia  Airlines  737  during  its  approach  to 
land  at  Canberra,  Australia.  The  airplane’s  FDR  data  indicated  that  a  cross-control  condition  existed  for 
about  21  seconds  during  the  airplane’s  right  turn  to  align  with  the  runway.  FDR  data  indicated  that  the  extent 
of  the  cross-control  varied  during  the  event;  at  its  most  severe,  the  cross-control  consisted  of  about  60°  of 
left  control  wheel  input  and  12°  of  right  rudder  pedal  input.  The  pilots  stated  that  they  perceived  an  airframe 
vibration  and  performed  a  go-around,  during  which  coordinated  control  was  maintained.  Throughout  the 
cross-control  event,  the  airplane’s  right  bank  remained  stable  at  20°  to  25°.  FDR  records  indicate  that  a 
similar  cross-control  situation  occurred  during  the  airplane’s  second  approach  to  the  runway.  That  cross¬ 
control  condition  was  less  severe;  the  pilots  resumed  coordinated  flight  and  an  uneventful  landing  ensued. 

Another  cross-control  condition  occurred  on  April  23,  1993,  and  involved  a  United  Airlines  737  that 
encountered  wake  turbulence  at  6,500  feet  msl  during  its  approach  to  its  destination  airport.  FDR  data 
indicated  that  the  incident  involved  about  9  seconds  of  rudder  activity,  during  which  moments  of  cross¬ 
control  occurred.  Maximum  rudder  input  during  this  event  was  less  than  7°.  On  July  25,  1995,  a  USAir  737 
was  approaching  to  land  at  Richmond,  Virginia.  Pilot  statements  and  incident  airplane  FDR  data  indicated 
that  the  pilots  responded  to  an  uncommanded  roll  event  appropriately  with  coordinated  left  aileron  and 
rudder.  However,  after  the  uncommanded  roll  event  subsided,  moments  of  cross-control  occurred  when 
several  degrees  of  left  rudder  input  remained  while  the  aileron  position  varied,  providing  mostly  right 
aileron  input  until  the  airplane  landed.  The  pilots’  statements  indicated  that  they  made  rudder  and  aileron 
inputs  “as  necessary  throughout  the  approach  and  landing  to  maintain  directional  control  of  the  aircraft.” 
Maximum  rudder  input  during  this  event  was  about  7°.  In  June  1997,  a  737  encountered  wake  turbulence  at 
10,000  feet  msl  behind  a  747.  FDR  data  from  the  incident  airplane  indicated  that  the  pilots  had  commanded 
right  aileron  and  right  rudder  as  the  airplane  began  to  roll  left  at  the  beginning  of  the  wake  encounter;  the 
right  rudder  input  remained  (although  reducing  gradually)  for  about  14  seconds,  but  moments  of  cross¬ 
control  occurred  when  the  aileron  input  varied  during  the  recovery.  Maximum  rudder  input  was  less  than  7°, 

Although  not  a  wake  turbulence  event,  an  example  of  an  accident  resulting  from  improper  rudder  input 
occurred  on  September  6,  1985,  and  involved  a  Midwest  Express  Airlines  DC-9  that  crashed  after 
experiencing  a  loss  of  engine  power  shortly  after  liftoff  (see  National  Transportation  Safety  Board.  1987. 
Accident  Involving  Midwest  Express  AirlineSy  Inc.,  Flight  105,  Douglas  DC-9-14,  NIOOME,  Milwaukee, 
Wisconsin,  September  6,  1985.  Aircraft  Accident  Report  NTSB/AAR-87/01.  Washington,  DC.)  The  Safety 
Board’s  accident  report  indicated  that,  because  of  the  airplane’s  nose-high  pitch  attitude,  the  pilots  were 
operating  with  reduced  external  visual  cues.  Although  the  pilots  initially  applied  correct  rudder  in  response 
to  the  loss  of  engine  power,  incorrect  rudder  was  applied  about  4  to  5  seconds  later. 
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1.18.8  Ergonomics — Study  of  Maximum  Pilot  Rudder 
Pedal  Force 

As  previously  discussed,  one  of  the  variables  in  the  Safety  Board’s  computer 
simulations  v^^as  pilot  rudder  pedal  force.  Because  pilot  rudder  pedal  force  was  not 
recorded  by  the  FDRs  in  the  USAir  flight  427,  United  flight  585,  and  Eastwind  flight  517 
airplanes,  the  Safety  Board  conducted  a  study,  using  ergonomic  research  and  other  data,  to 
estimate  the  rudder  pedal  forces  that  the  pilots  might  have  applied  during  the  upset  events. 

A  researcher  at  the  USAF’s  Armstrong  Laboratory  studied  strength  capability  for 
operating  aircraft  controls  in  a  study  often  used  as  a  standard  for  aircraft  design.^^^  The 
data  reported  in  this  study  represent  the  maximum  isometric  strength  demonstrated  by 
USAF  subjects  operating  the  aircraft  controls  of  a  laboratory  simulator.  Subjects  were 
healthy  volunteers,  either  from  the  Air  Force  Academy  (AFA)  or  Officer’s  Training 
School  (OTS),  who  were  instructed  to  push  forward  on  the  rudder  pedal  with  as  much 
force  as  they  could  exert  and  hold  that  force  for  5  seconds. 

Among  199  of  the  subjects  (male  AFA  students  between  19  and  25  years  old), 
median  strength  output  of  the  left  leg  against  the  left  rudder  pedal  was  624  pounds,  and 
median  strength  output  of  the  right  leg  against  the  right  rudder  pedal  was  623  pounds. 
Among  249  other  subjects  (male  OTS  students  between  21  and  34  years  old),  median 
strength  output  of  the  right  and  left  legs  was  510  pounds  each.  These  results  were  some  of 
the  highest  leg  force  outputs  obtained  in  a  laboratory  setting  and  cited  in  the  available 
ergonomic  literature,^’’  even  when  the  results  were  compared  with  other  studies  using 
USAF  subjects.^’® 

The  results  from  the  USAF  study  involving  OTS  subjects  were  considered  to  be 
more  representative  of  the  airline  pilot  population  for  two  reasons:  the  OTS  subjects 
(although  physically  fit)  were  not  subject  to  the  rigorous  physical  selection  and  exercise 


See  National  Transportation  Safety  Board.  1994.  Safety  Issues  Related  to  Wake  Vortex  Encounters 
During  Visual  Approach  to  Landing.  Special  Investigative  Report  NTSB/SIR-94/01.  Washington,  DC. 

^’^ASRS  reports  of  wake  turbulence  encounters  by  general  aviation  and  air  carrier  pilots  increased  after 
NASA  began  its  Wake  Turbulence  Project  in  April  1995,  which  was  publicized  in  the  piloting  community. 
Before  1995,  ASRS  received  an  average  of  55  wake  turbulence  reports  annually.  In  1995,  109  reports  of 
wake  turbulence  encounters  were  received.  In  1996, 60  reports  were  filed,  and  87  reports  were  filed  in  1997. 

In  many  cases,  review  of  the  FDR  data  revealed  that  the  flight  crews  overestimated  the  degree  of 
bank  experienced  as  a  result  of  the  wake  turbulence  encounters.  The  flight  crew  of  Eastwind  flight  517 
overestimated  the  degree  of  bank  experienced  during  the  incident. 

The  data  reported  here  were  extracted  by  ASRS  staff  at  the  request  of  the  Safety  Board  to  focus  on 
reports  from  pilots  of  multi-engine  turbojets. 

McDaniel,  J.W.  1995.  “Strength  capability  for  operating  aircraft  controls.”  SAFE  Journal,  25, 
pp.  28-34. 

Weimer,  J.  1993.  Handbook  of  ergonomic  and  human  factors  tables.  Englewood  Cliffs,  New  Jersey: 
Prentice  Hall,  pp.  90-91. 

Hertzberg,  H.T.E.,  and  Burke,  F.E.  1971.  “Foot  forces  exerted  at  various  aircraft  brake-pedal  angles.” 
Human  Factors,  13,  pp.  445-56. 
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requirements  that  were  applied  to  the  AFA  students,  and  the  OTS  students,  on  average, 
were  older  than  the  AFA  subjects.  Therefore,  the  Safety  Board  used  the  results  of  the 
USAF  studies  involving  OTS  subjects  as  a  baseline  for  its  ergonomic  study;  an  output  of 
510  pounds,  sustained  for  a  short  period  of  time,  was  deemed  as  a  reasonable  estimate  for 
the  maximum  leg  force  output  of  an  airline  transport  pilot. 

In  evaluating  the  leg  force  that  could  have  been  applied  during  the  three  upset 
events,  the  Safety  Board  also  considered  the  effect  that  seat  position  and  knee  angle  would 
have  on  that  force.  Ergonomic  studies  indicate  that  an  individual’s  maximum  potential  leg 
thrust  varies  dramatically  with  knee  angle,  with  an  optimal  knee  angle  range  of  between 
140  and  160°  (180°  corresponds  to  a  straight  leg).^'^^  (The  knee  angles  of  the  subjects  in 
the  USAF  studies  were  between  130  and  140°  for  a  neutral  pedal  position,  which  provided 
for  adequate  leg  extension  to  obtain  a  full  rudder  input  with  the  most  effective  knee 
angles.) 

The  Safety  Board  also  considered  the  effect  that  age  might  have  on  a  pilot’s  ability 
to  exert  leg  forces  approaching  those  demonstrated  in  the  USAF  studies.  Research 
indicates  a  loss  of  strength  in  leg  extension  forces  among  subjects  older  than  those  in  the 
USAF  studies  (about  a  6  percent  reduction  in  strength  per  decade  in  individuals  older  than 
30  years  old).^*®  However,  studies  also  indicate  that  general  muscle  loss  can  be  prevented 
or  reversed  as  a  result  of  regular  exercise.^** 

Further,  the  Safety  Board  researched  the  correlation  between  physical  size  (such  as 
height)  and  leg  strength  and  found  that  the  correlation  between  the  two  was  low.  In  other 
words,  the  research  showed  that  a  shorter  person  may  be  extremely  strong,  whereas  a 
taller  person  may  be  comparatively  weak. 

The  Safety  Board  recognizes  that  a  pilot’s  leg  force  output  in  a  real  cockpit 
emergency  (such  as  those  that  occurred  on  USAir  flight  427,  United  flight  585,  and 
Eastwind  flight  517)  may  also  depend  on  the  motivation  and  perception  of  the  pilots  about 
their  situation.  Thus,  laboratory  results  may  not  necessarily  replicate  actual  flight 
situations. 


Woodson,  W!E.,  Tillman,  B.,  and  Tillman,  P.  1993.  Human  Factors  Design  Handbook.  New  York: 
McGraw  Hill.  Kroemer,  K.H.E.,  Kroemer,  H.B.,  and  Kroemer-Elbert,  K.E.  1994.  Ergonomics:  how  to 
design  for  ease  and  efficiency.  Englewood  Cliffs,  New  Jersey:  Prentice  Hall,  p.  379. 

Hortob’agyi,  T,  Zheng,  D.,  Weidner,  M.,  Lambert,  N.J.;  Westbrook,  S.;  and  Houmard,  J.A.  1995. 
‘The  influence  of  aging  on  muscle  strength  and  muscle  fiber  characteristics  with  special  reference  to 
eccentric  strength.”  Journal  of  Gerontology,  Biological  Sciences,  50:  B399-406.  Bemben,  M.G.,  Massey, 
B.H.,  Bemben,  D.A.,  Misner,  J.E.,  and  Boileau,  R.A.  1996.  “Isometric  intermittent  endurance  of  four  muscle 
groups  in  men  aged  20-74  yr.”  Medicine  and  Science  in  Sports  and  Exercise,  28  (1),  pp.  145-54.  Borges,  O. 
1989.  “Isometric  and  isokinetic  knee  extension  and  flexion  torque  in  men  and  women  aged  20-70.  ” 
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Therefore,  in  estimating  the  maximum  rudder  pedal  force  applied  by  the  flying 
pilots  in  the  USAir  flight  427  and  United  flight  585  accidents  and  the  Eastwind  flight  517 
incident,  the  Safety  Board  used  the  available  ergonomic  and  other  data,  including  the  leg 
strength  results  from  the  USAF  OTS  subject  study  and  the  pilot’s  knee  angle,  age, 
physical  fitness,  physical  size,  motivation,  and  perception  of  the  situation.  In  the  case  of 
the  Eastwind  flight  517  incident,  the  Safety  Board  also  used  the  flight  crew’s  statements, 
the  flying  pilot’s  actual  knee  angle,  and  pilot  rudder  pedal  force  measurements. 

USAir  Flight  427 

The  Safety  Board  modeled  the  pedal  forces  exerted  by  the  first  officer  of  USAir 
flight  427  based  on  the  pilot  rudder  pedal  force  norms  identified  in  the  USAF  OTS  study. 
The  first  officer,  who  was  6  feet  3  inches  tall,  was  reported  to  be  healthy  and,  at  38  years 
old,  might  have  been  subject  to  a  small  degradation  in  leg  extension  strength  (perhaps  6 
percent)  compared  with  the  younger  USAF  OTS  subjects.  The  CVR  indicated  physical 
straining  sounds  over  a  period  of  less  than  5  seconds  at  the  beginning  of  the  upset  period, 
which  was  consistent  with  the  period  of  maximum  effort  exerted  by  the  subjects  in  the 
USAF  study.  Thus,  on  the  basis  of  his  age  (and  the  assumption  of  an  optimal  knee  angle), 
the  first  officer  could  be  expected  to  have  been  able  to  exert  about  480  pounds  of  force  on 
a  single  rudder  pedal  (510  pounds  minus  6  percent,  or  about  30  pounds). 

To  estimate  the  first  officer’s  probable  seat  position  and  knee  angle  during  the 
upset,  postaccident  ergonomic  measurements  were  conducted  in  a  737  cockpit  using  a 
Safety  Board  employee  who  was  similar  to  the  first  officer  in  height,  weight,  and  inseam 
measurement.^^^  The  Safety  Board  employee  found  it  necessary  to  place  the  right-hand 
cockpit  seat  in  its  farthest  aft  position  and  the  rudder  pedal  adjustment  in  its  farthest 
forward  position  for  optimal  flight  control  usability  and  leg  room  comfort.  He  adjusted  the 
seat  height  to  the  correct  eye  reference  position,  according  to  guidance  in  the  USAir 
Operations  manual.^*^  In  this  position,  the  Safety  Board  employee’s  right  knee  angle  was 
133°  when  his  foot  was  pushing  on  the  right  rudder  pedal  in  its  neutral  position.  When  the 
right  rudder  pedal  was  displaced  114  inches  aft  (toward  the  Safety  Board  employee),  his 
right  knee  angle  was  122°. 

Ergonomic  research  indicates  that  a  pilot’s  maximum  leg  thrust  with  a  122°  knee 
angle  would  be  further  degraded  by  about  28  percent  (compared  with  the  130  to  140° 
range  in  the  USAF  study).  The  Safety  Board  used  the  blowdown  limit  for  USAir  flight 
427  to  calculate  that  the  right  rudder  pedal  would  likely  have  moved  about  1  inch  aft  of  its 
neutral  position,  causing  the  first  officer’s  knee  angle  to  diverge  from  the  optimum  range. 
On  the  basis  of  this  information  and  the  results  of  measurements  of  the  Safety  Board 


Information  about  the  first  officer’s  height  and  weight  was  based  on  his  most  recent  flight  physical. 
The  first  officer’s  inseam  measurement  was  provided  by  his  wife. 

According  to  US  Airways  personnel,  no  eye  reference  adjustment  device  was  in  the  cockpit  of  the 
accident  airplane.  The  company  737  Pilot’s  Handbook  directed  pilots  to  adjust  the  seat  for  the  correct  eye 
reference  position,  which  is  established  when  the  top-most  flight  mode  annunciators  are  just  in  view  below 
the  glareshield  and,  at  the  same  time,  a  slight  amount  of  the  aircraft  nose  structure  is  visible  above  the 
forward  lower  window  sill. 
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employee’s  seat  position  and  knee  angle,  the  Safety  Board  assumed  that  the  USAir  flight 
427  first  officer’s  right  rudder  pedal  force  was  reduced  about  15  to  20  percent  as  the  right 
rudder  pedal  moved  aft  during  the  upset  event. 

Accordingly,  on  the  basis  of  the  available  information,  the  Safety  Board’s 
computer  simulation  studies  (discussed  in  section  1.16.6.1)  assumed  that  the  first  officer 
of  USAir  flight  427  would  have  applied  an  initial  maximum  force  of  about  400  pounds  on 
the  right  rudder  pedal  in  response  to  a  rudder  reversal.  Further,  the  simulation  studies 
assumed  that  the  first  officer  reduced  his  leg  force  on  the  right  rudder  pedal  by  about 
50  percent  (to  about  200  pounds)  later  in  the  upset  sequence  when  he  would  have  been 
maintaining  rudder  pedal  pressure  but  making  less  than  a  maximum  effort  so  he  could 
attend  to  other  aspects  of  the  emergency.  (See  section  2.2.2  for  more  discussion  of  this 
rudder  pedal  force  reduction.) 

United  Flight  585 

The  captain  of  United  flight  585  was  5  feet  7  inches  tall,  which  permitted  him  to 
make  seat  adjustments  that  could  have  obtained  an  optimum  knee  angle  for  exerting  force 
on  the  rudder  pedals  (unlike  the  first  officer  of  USAir  flight  427).  The  captain  was 
assumed  to  have  selected  a  seat  and  rudder  pedal  adjustment  that  resulted  in  the  optimal 
(130  to  140°)  knee  angle  with  the  rudder  pedals  in  the  neutral  position  and  allowed  for  leg 
extension  to  command  full  rudder.  (The  CVR  transcript  indicates  that  the  captain 
performed  a  rudder  check  before  takeoff,^^'^  which  would  have  required  the  captain  to 
adjust  his  seat  position  to  allow  for  the  full  range  of  motion  on  the  rudder  pedals.) 
Although  the  captain’s  age  (52  years)  might  have  resulted  in  some  degradation  in 
maximum  leg  force,^*^  postaccident  interviews  indicated  that  the  captain  was  in  excellent 
health  and  followed  a  rigorous  exercise  regimen. 

Because  the  captain’s  personal  health  characteristics  might  have  countered  the 
normal  age-related  loss  of  strength,  the  Safety  Board  did  not  reduce  its  estimate  of  the 
captain’s  leg  force  from  the  USAF  norms  based  on  his  age.  However,  the  United  flight  585 
circumstances  indicated  that,  in  a  rudder  reversal  situation,  the  left  rudder  pedal  could 
move  as  much  as  3  inches  aft  (toward  the  captain)  during  the  rudder’s  movement  to  its 
blowdown  limit  (and  within  about  1  additional  second  as  sideslip  allowed  the  rudder  to 
deflect  more).  This  rudder  pedal  movement  would  have  forced  the  captain  to  use  a  less 
effective  knee  angle  than  that  of  the  USAF  OTS  subjects,  which  would  have  reduced  his 
rudder  pedal  input  force. 

Further,  because  of  the  suddenness  of  the  United  flight  585  upset  and  the  airplane’s 
rapid  departure  from  controlled  flight,  it  is  possible  that  the  captain  never  reached  his 
personal  maximum  leg  force  effort.  In  the  short  time  available  to  recover  from  the  upset, 
the  captain  may  have  pushed  hard  on  the  left  rudder  pedal  only  long  enough  to  realize  that 


The  CVR  transcript  indicates  that,  at  0914:20,  before  taxiing  for  takeoff,  the  captain  warned  the  first 
officer  to  “watch  your  feet  here  comes  the  rudder.” 

Research  indicated  that  a  loss  of  about  15  percent  in  pilot  rudder  pedal  force  might  be  expected  in  an 
individual  the  same  age  as  the  captain. 
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there  was  a  serious  problem  in  the  flight  control  and  then  shifted  his  focus  to  attempt  a 
go-around  and  stop  the  yaw/roll  with  control  wheel  inputs.  Therefore,  on  the  basis  of  the 
available  information,  the  Safety  Board’s  simulation  studies  assumed  that  the  captain 
applied  a  force  of  about  300  pounds  during  the  brief  period  between  pedal  input  and  the 
go-around  decision/control  wheel  input  and  that  he  subsequently  reduced  his  rudder  pedal 
force  to  about  200  pounds  (see  section  2.3.2  for  more  discussion  of  the  force  reduction).^®* 

Eastwind  Flight  517 

The  captain  of  Eastwind  flight  517  was  5  feet  10  inches  tall.  Postincident 
measurements  in  a  cockpit  identical  to  that  of  the  incident  airplane  showed  that,  when  the 
seat  and  rudder  pedals  were  adjusted  to  the  positions  the  captain  normally  used  in  landing, 
his  left  knee  angle  was  130°  when  his  left  foot  was  pushing  the  left  rudder  pedal  in  its 
neutral  position.  The  captain  estimated  that,  during  the  incident,  the  left  rudder  pedal 
moved  IV2  inches  forward  of  its  neutral  position  in  response  to  his  efforts  to  depress  it.^®’ 
With  the  left  rudder  pedal  in  this  position,  the  captain’s  left  knee  angle  was  140°  when  his 
left  foot  pushed  the  pedal.  Further,  when  the  captain  demonstrated  how  he  “stood  on  the 
pedal”  during  the  incident  to  gain  greater  pushing  force,  he  used  a  raised  posture  in  which 
his  body  moved  upward  by  2  inches  (as  measured  at  the  shoulder).  In  this  posture,  his  left 
knee  angle  was  145°  when  he  pushed  on  the  left  pedal,  which  was  displaced  IVi  inches 
forward  of  its  neutral  position.  Ergonomic  literature  indicates  that  this  posture  may  have 
increased  the  captain’s  maximum  leg  force  by  as  much  as  35  percent  compared  with  the 
USAF  OTS  subject  norm. 

During  postincident  testing,  the  captain  displayed  a  leg  strength  on  a  standard 
medical  rehabilitation  testing  protocol  that  placed  him  below  average  compared  with 
norms  established  by  a  sample  of  healthy,  recreationally  active  adults.  However,  in 
allowing  for  the  advantage  that  may  have  been  provided  by  his  effective  knee  angle,  the 
Safety  Board  assumed  that  the  captain  could  produce  a  maximum  force  in  the  500-pound 
range  when  “standing”  on  the  rudder  pedal  to  oppose  a  rudder  reversal. 

On  the  Eastwind  flight  517  airplane,  a  force  of  about  300  pounds  would  have  been 
required  to  move  the  rudder  pedal  beyond  its  neutral  position  in  a  rudder  reversal 
situation.  Therefore,  the  captain’s  demonstration  to  investigators  of  the  left  rudder  pedal 
position  that  he  recalled  obtaining  during  the  incident  (about  IV2  inches  forward  of 
neutral)  would  correspond  to  an  effort  of  about  450  pounds.  This  rudder  pedal  force  is 


This  model  of  pilot  rudder  pedal  force  was  considered  the  most  appropriate,  but  a  second  model  also 
provided  a  good  fit  of  the  data.  In  this  second  model,  the  captain  was  assumed  to  have  initially  input  a  rudder 
pedal  force  of  about  500  pounds  and  then  reduced  this  input  force  to  250  pounds. 

During  a  June  14,  1996,  interview,  the  captain  stated  that  he  stood  hard  on  the  rudder  pedal  and 
applied  about  3  to  4  inches  rudder  displacement.  During  a  June  17,  1998,  interview,  the  captain  stated  that 
the  rudder  pedals  moved  no  more  than  1  or  2  inches.  In  a  February  4, 1999,  cockpit  test,  in  which  the  captain 
moved  actual  rudder  pedals,  the  left  pedal  moved  downward  by  IV2  inches  on  his  first  demonstration  and  by 
1-5/8  inches  on  his  second  demonstration  (as  measured  by  a  Safety  Board  investigator  seated  in  the  opposite 
pilot  seat).  On  the  basis  of  all  four  estimates,  and  the  simplicity  of  a  pedal  demonstration  compared  with  a 
verbal  description,  the  Safety  Board  employed  a  IVa-inch  displacement  as  a  representation  of  the  captain's 
recall.  (A  4-inch  displacement  would  move  the  pedal  down  to  its  lower  stop,  which  would  contradict  the 
captain's  numerous  reports  that  the  pedal  was  stiff  and  would  not  go  down  to  the  floor.) 
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consistent  with  the  Board’s  estimates  based  on  the  USAF  data,  adjusted  for  the  captain’s 
measured  strength  and  knee  angles. 

Accordingly,  on  the  basis  of  the  available  information,  the  Safety  Board  s 
simulation  studies  assumed  that  the  captain’s  initial  rudder  pedal  force  was  about  500 
pounds.  The  simulation  studies  further  assumed  that  this  rudder  pedal  force  was  reduced 
later  in  the  incident  sequence  (see  section  2.4.2  for  more  discussion  of  the  force 
reduction). 

1.18.9  Unusual  Attitude  Information  and  Training 

The  FAA’s  AC  61-27C,  “Instrument  Flying  Handbook,”  defines  an  unusual 
attitude  as  “...any  airplane  attitude  not  normally  required  for  instrument  flight.”  The  AC 
states  that  an  unusual  attitude  may  result  from  “a  number  of  conditions,  such  as 
turbulence,  disorientation.  ..or  lack  of  proficiency  in  aircraft  control.” 

The  Airplane  Upset  Recovery  Training  Aid  (developed  in  1997  and  1998  by  a 
working  group,  as  described  in  section  1.18.9.2)  states  that  while  specific  values  may 
vary  among  airplane  models,  the  following  unintentional  conditions  generally  describe  an 
airplane  upset  [unusual  attitude]:  Pitch  attitude  greater  than  25°  nose  up;  pitch  attitude 
greater  than  10°  nose  down;  bank  angle  greater  than  45°;  and  within  the  above  parameters, 
but  flying  at  airspeeds  inappropriate  for  the  conditions.” 

1.18.9.1  Preaccident  Activity 

Before  the  USAir  flight  427  accident,  the  Safety  Board  had  issued  three  safety 
recommendations  that  addressed  training  flight  crews  involved  in  14  CFR  Part  121 
operations  in  the  recognition  of  and  recovery  from  unusual  flight  attitudes.  Safety 
Recommendation  A-70-21,  issued  on  May  1,  1970,  referenced  an  accident  that  occurred 
on  November  16,  1968,  in  which  a  flight  crew  lost  control  of  a  737  near  Detroit, 
Michigan,  in  poor  weather  conditions.^**  The  Safety  Board  recommended  additional  flight 
crew  training  in  which  pilots  would  be  required  to  periodically  demonstrate  proficiency  in 
recovery  from  unusual  attitudes.  The  Safety  Board  also  suggested  that  a  simulator  be 
utilized  to  provide  flight  crew  familiarization  with  (1)  the  various  instrument  displays 
associated  with  and  resulting  from  encounters  with  unusual  meteorological  conditions, 
(2)  the  proper  flight  crew  response  to  the  various  displays,  and  (3)  demonstration  of  and 
recovery  from  possible  ensuing  unusual  attitudes. 

In  its  May  21,  1970,  letter  to  the  Safety  Board,  the  FAA  stated  that  airline  training 
was  now  emphasizing  the  proper  use  of  trim,  attitude  control,  and  thrust,  which  the  FAA 
believed  was  far  more  effective  than  the  practice  of  recovery  from  unusual  attitude 
maneuvers.  The  FAA  indicated  that  unusual  attitude  maneuvers  had  been  deleted  from  the 
pilot  proficiency  check  in  1965.  The  FAA  also  believed  that  it  was  inconceivable  to 
require  training  maneuvers  that  would  place  a  large  jet  airplane  in  a  nose  high,  low 
airspeed,  high  angle-of-attack  situation. 


See  National  Transportation  Safety  Board.  1969.  NTSB  Log  69-0115,  notation  413. 
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In  a  July  8,  1970,  letter  to  the  Safety  Board,  the  FAA  stated  to  the  Safety  Board 
that  changes  in  airline  training  and  operational  procedures  had  resulted  from  this  safety 
recommendation  and  cited  a  “marked  decrease  in  upset  events”  as  evidence  that  these 
actions  had  addressed  the  intent  of  the  recommendation.  The  FAA  further  stated  that  it 
would  discuss  with  industry  representatives  the  feasibility  of  simulating  large  excursions 
from  flightpath  caused  by  abnormal  meteorological  conditions.  Because  no  further  action 
was  taken  by  the  FAA,  the  Safety  Board  classified  Safety  Recommendation  A-70-21 
“Closed — Unacceptable  Action”  on  August  17, 1972. 

On  March  31,  1971,  a  Boeing  720B  yawed  and  crashed  while  the  flight  crew  was 
attempting  a  three-engine  missed  approach.  The  Safety  Board  attributed  the  probable 
cause  of  the  accident  to  a  failure  of  the  airplane’s  rudder  actuator  and  expressed  concerns 
regarding  the  flight  crew’s  ability  to  rapidly  assess  the  situation  and  recover.  As  a  result  of 
this  accident,  the  Safety  Board  issued  Safety  Recommendation  A-72-152,  which  asked  the 
FAA  to  require  pilots  to  demonstrate  their  ability  to  recover  from  abnormal  regimes  of 
flight  and  unusual  attitudes  solely  by  reference  to  flight  instruments.  The  Board 
recommended  the  use  of  simulators  for  this  demonstration  and  noted  that  current 
simulators  should  be  modified  if  they  were  not  capable  of  being  used  for  this  purpose. 

In  its  response,  the  FAA  stated  that  it  did  not  believe  that  simulators  were  capable 
of  simulating  certain  regimes  of  flight  that  go  beyond  the  normal  flight  envelope  of  the 
aircraft.  Further,  because  an  aircraft  simulator  is  not  required  as  part  of  an  air  carrier 
training  program,  the  FAA  stated  that  it  could  not  require  that  a  simulator  be  replaced  or 
modified  to  simulate  regimes  of  flight  outside  the  flight  envelope  of  the  aircraft.  On  the 
basis  of  this  response.  Safety  Recommendation  A-72-152  was  classified  “Closed — 
Unacceptable  Action”  on  January  16, 1973. 

The  Safety  Board  issued  Safety  Recommendation  A-92-20  as  a  result  of  a  July  10, 
1991,  Beech  C99  accident  at  Birmingham,  Alabama.^*^  The  recommendation  asked  the 
FAA  to  require  that  recurrent  training  and  proficiency  programs  for  instrument-rated  pilots 
include  techniques  for  recognizing  and  recovering  from  unusual  attitudes. 

In  its  July  9, 1992,  letter  to  the  Safety  Board,  the  FAA  stated  that  pilots  are  already 
required  to  demonstrate  recovery  from  unusual  flight  attitudes  on  their  private  pilot 
examination.  In  addition,  the  FAA  noted  that  the  instrument  rating  requires  a  pilot  to  be 
proficient  in  recovery  from  unusual  attitudes.  Therefore,  the  FAA  believed  that,  by  the 
time  a  pilot  had  the  required  experience  to  become  part  of  a  flight  crew  with  a  14  CFR  Part 
121  or  135  air  carrier,  the  pilot  would  have  received  extensive  training  and  flight  checks 
for  procedures  and  techniques  in  recovery  from  unusual  attitudes.  The  FAA  further  cited 
existing  requirements  for  the  ATP  certificate  and  pilot  training  under  Part  121,  including 
recovery  from  “specific  flight  characteristics  that  are  considered  reasonably  probable  for 
the  airplane  (such  as  dutch  roll  recovery  in  the  Boeing  727),  steep  turns,  approaches  to 
stalls,  and  the  windshear  escape  maneuver.” 


For  more  information,  see  National  Transportation  Safety  Board.  1992.  L’Express  Airlines,  Inc., 
Flight  508  Beech  C99,  N72171,  Weather  Encounter  and  Crash  Near  Birmingham,  Alabama,  July  10,  1991. 
Aircraft  Accident  Report  NTSB/AAR-92/01 .  Washington,  DC. 
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In  a  January  26,  1993,  letter  to  the  FAA,  the  Safety  Board  stated  that  it  continued 
to  believe  that  instrument-rated  pilots  should  receive  recurrent  training  in  techniques  for 
recognizing  and  recovering  from  unusual  attitudes  and  that  proficiency  programs  should 
include  this  same  training.  The  letter  also  stated  the  Board’s  belief  that  requiring  such 
training  annually  would  greatly  enhance  a  pilot’s  ability  to  safely  recover  from  an  unusual 
attitude.  Because  the  FAA  planned  no  additional  response.  Safety  Recommendation 
A-92-20  was  classified  “Closed — Unacceptable  Action.” 

The  Safety  Board’s  accident  report  of  a  DC-8-63,  near  Swanton,  Ohio,  on 
February  15,  1992,^^  addressed  the  subject  of  airline  pilots’  reluctance  to  aggressively 
apply  flight  controls.  The  report  stated  the  following: 

...basic  control  manipulations  by  the  first  officer  during  the  recovery 
attempt  were  in  general  accordance  with  accepted  procedures  in  that  he 
attempted  to  roll  the  wings  level  and  then  began  pulling  the  nose  up.  If  he 
had  been  more  aggressive  with  both  sets  of  controls,  he  might  have 
succeeded.  A  larger,  more  rapid  aileron  input  would  have  leveled  the  wings 
faster[,]  and  a  more  aggressive  pullout  could  have  been  within  the 
operating  envelope  of  the  aircraft....  Obviously,  this  situation  called  for 
extremely  quick  and  aggressive  control  inputs. 

According  to  USAir  flight  training  personnel,  the  flight  training  syllabus  at  the 
time  of  the  USAir  flight  427  accident  included  pilot  training  in  the  following  maneuvers: 

•  recovery  from  approaches  to  stalls, 

•  recovery  from  a  dutch  roll, 

•  high-speed  buffet, 

•  steep  turns  (45°  bank),  and 

•  windshear  escape. 

However,  the  Safety  Board’s  review  of  the  USAir  training  syllabus  that  was  in 
effect  before  the  accident  for  both  the  ground  and  simulator  training  programs  revealed 
that  the  training  being  conducted  did  not  include  recovery  from  unusual  attitudes  or 
upsets,  as  defined  in  AC  61-27C  or  in  the  Airplane  Upset  Recovery  Training  Aid. 

Additionally,  the  Safety  Board  surveyed  the  content  of  the  flight  training  syllabi  of 
six  other  major  airlines  at  the  time  of  the  flight  427  accident.  Of  the  six  airlines  surveyed, 
five  had  training  syllabi  similar  to  the  USAir  training  syllabus.  The  sixth.  United  Airlines, 
had  recently  developed  and  implemented  an  Advanced  Maneuvers  Package^^’  for  its 
Boeing  757  and  767  flight  crew  simulator  training  program.  According  to  United  Airlines 


See  National  Transportation  Safety  Board.  1992.  Air  Transport  International,  Inc.,  Flight  805, 
DC-8-63,  N794AL,  Loss  of  Control  and  Crash,  Swanton,  Ohio,  February  15,  1992.  Aircraft  Accident  Report 
NTSB/AAR-92/05.  Washington,  DC. 

United  Airlines’  training  captains  developed  the  Advanced  Maneuvers  Package  over  a  2-year  period, 
and  it  was  incorporated  into  the  757  and  767  training  program  in  July  1994.  The  program  involves 
recognition  and  recovery  from  unusual  flight  attitudes,  including  nose  high,  nose  low,  and  inverted. 
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flight  training  personnel,  the  Advanced  Maneuvers  Package  received  an  “overwhelmingly 
positive”  response  from  flight  crews  and  instructors,  and  the  airline  was  incorporating  the 
training  throughout  its  fleet. 

On  July  13,  1993,  Boeing  published  a  Flight  Operations  Review  article,  which 
addressed  the  subject  of  unwanted  roll  tendencies,  as  follows: 

If  aileron  control  is  affected,  rudder  inputs  can  assist  in  countering 
unwanted  roll  tendencies.  The  reverse  is  also  true  if  rudder  control  is 
affected. 

If  both  aileron  and  rudder  control  are  affected,  the  use  of  asymmetrical 
engine  thrust  may  aid  roll  and  directional  control. 

When  encountering  an  event  of  the  type  described  above,  the  flightcrew’s 
first  consideration  should  be  to  maintain  or  regain  full  control  of  the 
airplane  and  establish  an  acceptable  flight  path.  This  may  require  the  use  of 
unusual  techniques  such  as  the  application  of  full  aileron  or  rudder. 

1.18.9.2  Postaccident  Activity 

On  August  16,  1995,  the  FAA  disseminated  Flight  Standards  Handbook  Bulletin 
for  Air  Transportation  (HBAT)  95-10,  entitled  “Selected  Events  Training”  (SET),  to  its 
principal  operations  inspectors  (POI).  The  HBAT  contains  “...guidance  and  information 
on  the  approval  and  implementation  of  ‘Selected  Events  Training’  for  operators  training 
under  14  CFR  Part  121,  who  use  flight  simulation  devices  as  part  of  their  flight  training 
programs.” 

The  HBAT  states  that  the  SET  is  “voluntary  flight  training  in  hazardous  inflight 
situations  which  are  not  specifically  identified  in  FAA  regulations  or  directives.”  Some  of 
the  examples  of  these  selected  events  include  false  stall  warning  in  rotation,  excessive  roll 
attitude  (in  excess  of  90°),  and  high  pitch  attitude  (in  excess  of  35°).  The  HBAT  further 
states  that  the  SET  program  was  developed  jointly  by  the  FAA  and  the  aviation  industry  in 
response  to  previously  issued  Safety  Board  recommendations  addressing  the  need  for 
unusual  events  and  unusual  attitude  training  for  Part  121  and  135  air  carrier  pilots. 

In  1996,  USAir  implemented  SET  as  a  required  recurrent  training  element  for  all 
of  its  pilots.  The  training  program  at  USAir  included  simulator  training  in  recovering  from 
nose  high,  nose  low,  and  inverted  airplane  attitudes.  Also,  many  air  carriers  began 
implementing  SET/Advanced  Maneuvers  Package  programs  patterned  after  the  guidelines 
of  the  FAA’s  HBAT  95-10  and  United  Airlines’  program,  respectively. 

On  October  18, 1996,  the  Safety  Board  issued  Safety  Recommendation  A-96-120. 
This  recommendation  asked  the  FAA  to  require  14  CFR  Part  121  and  135  operators  to 
provide  training  to  flight  crews  in  the  recognition  of  and  recovery  from  unusual  attitudes 
and  upset  maneuvers,  including  upsets  that  occur  while  the  aircraft  is  being  controlled  by 
automatic  flight  control  systems  and  unusual  attitudes  that  result  from  flight  control 
malfunctions  and  uncommanded  flight  control  surface  movements. 
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In  a  January  16,  1997,  letter  to  the  Safety  Board,  the  FAA  stated  that  it  was 
considering  an  NPRM  proposing  to  require  that  air  carriers  conduct  training  that  will 
emphasize  recognition,  prevention,  and  recovery  from  aircraft  attitudes  that  are  normally 
not  associated  with  air  carrier  flight  operations.  In  its  July  15,  1997,  response,  the  Safety 
Board  stated  that  it  was  not  aware  of  any  training  programs  that  specifically  addressed 
unusual  attitudes  that  resulted  from  a  control  system  failure  or  for  which  some  flight 
controls  would  not  be  available,  or  would  be  counterproductive  to,  the  recovery.  (This 
recommendation  is  discussed  more  fully  in  section  1.18.11.5.) 

In  a  November  2,  1998,  letter  to  the  FAA,  the  Safety  Board  listed  those  safety 
recommendations,  including  A-96-120,  for  which  no  recent  action  had  been  taken  by  the 
FAA.  In  a  January  13, 1999,  letter  to  the  Safety  Board’s  Director  of  the  Office  of  Aviation 
Safety,  the  FAA’s  Associate  Administrator  for  Regulation  and  Certification  stated  that 
“14  CFR  part  121,  subparts  N  and  O  (Training  Program  and  Crewmember  Qualifications, 
respectively),  are  being  extensively  rewritten.  The  rulemaking  is  expected  to  contain 
specific  requirements  addressing  the  NTSB’s  concerns.”  (See  section  2.7  for  the  Safety 
Board’s  review  and  evaluation  of  the  FAA’s  action  in  response  to  Safety  Recommendation 
A-96-120  and  the  recommendation’s  current  classification.) 

During  1997  and  1998,  a  working  group  composed  of  representatives  of  aircraft 
manufacturers,  air  carriers,  pilot  associations,  training  organizations,  and  government 
agencies  (including  the  FAA)  developed  the  Airplane  Upset  Recovery  Training  Aid.  This 
publication  and  video  program  provided  background  information  for  air  carrier  pilots  and 
managers  on  jet  aerodynamics,  stability,  control,  and  upset  recovery.  The  training  aid  also 
provided  a  model  curriculum  for  classroom  and  flight  simulator  training  in  recovering 
from  unusual  flight  attitudes.  As  of  late  1998,  the  Airplane  Upset  Recovery  Training  Aid 
publication  and  video  program  were  being  distributed  by  two  major  air  transport 
manufacturers  (Boeing  and  Airbus)  to  their  customers.  This  training  aid,  however,  does 
not  include  simulator  training  in  unusual  attitudes  resulting  from  flight  control 
malfunctions  and  uncommanded  flight  control  surface  movements. 

1.18.10  Procedural  Information  Available  to  Boeing  737 
Flight  Crews 

1.18.10.1  Preaccident  Information  Avaiiabie  to  737  Piiots  Regarding 
Abnormal  Procedures  (Flight  Controls  Malfunctions) 

The  abnormal  operations  section  of  the  USAir  737-300  Pilot’s  Handbook  that  was 
in  effect  at  the  time  of  the  flight  427  accident  contained  procedural  guidance  for  abnormal 
flight  control  and  hydraulic  system  conditions.  Page  1-307-3  of  the  Pilot’s  Handbook, 
dated  May  8,  1992,  listed  abnormal  checklist  procedures  for  flight  control  low  pressure 
and  yaw  damper  anomalies.  Page  1-307-6  of  the  Pilot’s  Handbook,  dated  June  17,  1994, 
listed  abnormal  checklist  procedures  for  “Jammed  or  Restricted  Flight  Controls.” 

Under  “Flight  Control  Low  Pressure,”  the  abnormal  checklist  procedures  stated: 
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Flight  Control  Switch . STBY  RUD  [bold  original  to  text] 

Placing  a  flight  control  switch  to  STBY  RUD  starts  the  standby 
hydraulic  pump  and  arms  the  STANDBY  LOW  PRESSURE  light.  The 
FLT  CONTROL  LOW  PRESSURE  light  extinguishes,  indicating  the 
standby  rudder  shutoff  valve  has  opened. 

CAUTION:  If  flight  control  malfunctions  are  indicated,  do  not 
deactivate  systems  until  the  cause  is  established.  If  any  flight  control 
caution  lights  illuminate  during  flight,  check  position  of  corresponding 
switches,  and  monitor  hydraulic  system  indications. 

CAUSE:  The  light  indicates  low  hydraulic  system  pressure  to  ailerons, 
elevators,  and  rudder. 

Under  “Yaw  Damper,”  the  abnormal  checklist  procedures  stated: 


Yaw  Damper  Switch . OFF,  THEN  ON  [bold  original  to  text] 

If  light  remains  illuminated;  [bold  original  to  text] 

Yaw  Damper  Switch . OFF  [bold  original  to  text] 


NOTE:  Flying  in  turbulence  with  the  yaw  damper  inoperative  can  be 
difficult,  and  uncomfortable  for  the  passengers.  Before  commencing  a 
flight  with  yaw  damper  inoperative,  insure  that  turbulence  (especially 
continuous  turbulence  of  moderate  or  greater  intensity)  can  be  avoided. 

Under  “Jammed  or  Restricted  Flight  Conditions,”  the  abnormal  checklist 
procedures  stated: 

This  procedure  is  accomplished  when  jammed  or  restricted  movement 
of  flight  controls  in  roll,  pitch,  or  yaw  control  is  experienced. 

Jammed  or  Restricted  System . ......OVERPOWER 

[bold  original  to  text] 

Use  maximum  force,  including  a  combined  effort  of  both  pilots,  if 
necessary. 

Note:  A  maximum  two-pilot  effort  on  the  control  will  not  cause  a  cable 
or  system  failure. 

Do  NOT  turn  off  any  flight  control  switches  unless  the  faulty 
control  is  positively  identified,  [bold  original  to  text] 

If  the  aileron  or  spoiler  is  jammed,  force  applied  to  the  Captain’s  and 
the  First  Officer’s  control  wheels  identifies  which  lateral  control 
system  (aileron  or  spoiler)  is  usable,  and  which  control 
wheel . . .  provides  roll  control .... 

With  a  jammed  elevator,  manual  or  electric  trim  may  be  used  to  trim  in 
either  direction  to  offload  control  column  forces. ... 
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Should  the  rudder  control  cable  system  fail,  inputs  to  the  rudder  can  be 
accomplished  through  the  rudder  trim  control  mechanism.  If  the  rudder 
pedals  are  jammed,  rudder  control,  rudder  trim,  and  nose  wheel  pedal 
steering  are  inoperative. 

If  freezing  water  is  the  suspected  cause,  consider  descent  to  warmer  air 
if  conditions  persist  and  re-attempt  to  override  the  jammed  or  restricted 
controls. 

If  faulty  system  cannot  be  overpowered,  use  operative  flight  controls, 
trim  and  toust,  as  required  for  airplane  control. 

1.18.10.2  Postaccident  Changes/Information  Available  to  737  Pilots 
Regarding  Abnormal  Procedures  (Flight  Controls  Malfunctions) 

1.18.10.2.1  1994  Through  1995— Information  and  Changes  Disseminated 
by  Boeing 

On  July  22,  1994,  (less  than  2  months  before  the  US  Air  flight  427  accident) 
Boeing  issued  an  internal  document  entitled  “Change  Proposal”  (Flight  Operations 
Review  Board  control  No.  2247).  The  document  recommended  that  the  737  Operations 
Manual  include  a  procedure  directing  the  flight  crew  to  turn  off  the  yaw  damper  if 
uncommanded  yaw  or  rudder  oscillations  occurred  in  flight.  The  document  also  noted  that 
the  737  AFM  stated  that  “if  directional  hunting  or  rudder  oscillations  occur,  turn  the  yaw 
damper  off’  but  that  the  Operations  Manual  did  not  include  a  similar  procedure.  In 
addition,  the  document  indicated  that  Air  France  had  questioned  the  discrepancy  between 
the  manuals  in  1993. 

On  December  9,  1994,  Boeing  issued  a  revision  to  its  737  Operations  Manual  that 
established  a  procedure  for  uncommanded  yaw.  Page  03.10.08  of  the  manual  stated: 

UNCOMMANDED  YAW 

Accomplish  this  procedure  if  uncommanded  yaw  or  rudder  oscillations 
occur  in  flight: 

YAW  DAMPER  SWITCH . OFF 

The  YAW  DAMPER  light  illuminates  when  the  yaw  damper  is 
disengaged. 

1.18.10.2.2  1996  Through  1997— FAA  Issuance  of  Airworthiness 
Directive  96-26-07 

On  December  23, 1996,  the  FAA  issued  AD  96-26-07,  effective  January  17, 1997. 
The  AD  required  revising  the  FAA-approved  AFM  for  all  737  series  airplanes  to  include 
procedures  that  would  enable  the  flight  crew  to  take  “appropriate  action  to  maintain 
control  of  the  airplane  during  an  uncommanded  yaw  or  roll  condition,  and  to  correct  a 
jammed  or  restricted  flight  control  condition.”  The  FAA  stated  that  the  AD  had  been 
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prompted  by  its  determination  that  such  procedures  were  not  adequately  defined  in  the 
existing  version  of  the  737  AFM. 

The  AD  established  a  “recall”  procedure  to  be  performed  by  flight  crews 
immediately,  from  memory,  in  the  event  of  an  uncommanded  yaw  or  roll.  The  recall 
procedure  stated,  “Maintain  control  of  the  airplane  with  all  available  flight  controls.  If  roll 
is  uncontrollable,  immediately  reduce  angle  of  attack  and  increase  airspeed.  Do  not 
attempt  to  maintain  altitude  until  control  is  recovered.  If  engaged,  disconnect  autopilot 
and  autothrottle.” 

The  AD  further  required  that  the  AFM  section  concerning  procedures  for  jammed 
flight  controls  be  modified  to  include  in  part  the  following: 

If  the  rudder  pedals  will  not  move  to  the  pilot-commanded  position,  or  if 
the  pedals  are  deflected  in  one  direction  and  jammed,  maintain  control  of 
the  airplane  with  all  available  flight  controls.  Disengage  the  autopilot  and 
autothrottle.  Use  maximum  force  (combined  effort  by  both  pilots)  to 
overpower  the  rudder  system. 

After  establishing  control  of  the  aircraft,  check  rudder  pedal  position.  If  the 
rudder  pedals  have  centered,  accomplish  a  normal  descent,  approach,  and 
landing.  If  the  rudder  pedals  remain  jammed  and  are  deflected  to  a  degree 
that  significantly  affects  the  controllability  of  the  airplane,  select  System  B 
flight  control  switch  to  STBY  RUD.  If  this  action  clears  the  jam/deflection, 
make  a  normal  approach  and  landing,  noting  that  rudder  control  may  be 
limited.  If  moving  the  System  B  flight  control  switch  to  STBY  RUD  does 
not  clear  the  jam,  select  System  A  flight  control  switch  to  OFF.  If  pedals  do 
not  center,  select  System  B  flight  control  switch  to  OFF. ... 

The  FAA  specified  that  air  carriers  could  comply  with  the  AD  by  inserting  a  copy 
of  it  in  the  AFM.  No  flight  crew  training  requirements  were  established  by  the  FAA  for  the 
procedures  that  had  been  introduced  or  changed  by  the  AD. 

On  March  3,  1997,  the  Safety  Board  provided  comments  to  the  FAA  about 
AD  96-26-07.  The  Board  expressed  concern  that  selecting  the  hydraulic  system  B  flight 
control  switch  to  standby  rudder  was  specified  by  the  FAA  as  a  followup  procedure  rather 
than  as  an  immediate  action  procedure.  The  Safety  Board  noted  that,  under  certain  failure 
conditions,  if  rudder  system  malfunctions  were  to  occur  at  a  relatively  low  altitude  and 
airspeed,  or  if  the  flight  crew’s  recovery  attempt  were  to  be  a  delayed  by  only  a  few 
seconds,  the  flight  crew  might  not  be  able  to  regain  control  of  the  airplane  from  the 
resulting  extreme  aircraft  attitude  and  roll  rate  without  immediately  moving  the  system  B 
flight  control  switch  to  the  standby  rudder  position. 

The  Safety  Board  recognized  the  potential  for  pilots  to  have  difficulty  identifying 
the  hydraulic  system  B  flight  control  switch  among  the  several  identically  shaped  and 
colored  switches  located  nearby  on  the  737  overhead  instrument  panel.  The  Board  noted 
the  possibility  of  changing  the  shape  and  color  of  the  system  B  flight  control  switch  to 
provide  greater  conspicuity  and  distinctness. 
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1.18.10.2.3  1997  Through  1998— Information  and  Changes  Disseminated 
by  Boeing 

On  February  17,  1997,  Boeing  issued  Operations  Manual  Bulletin  for  US  Air,  Inc., 
USA-17,  “Uncommanded  Yaw  or  Roll;  Jammed  or  Restricted  Rudder;  Jammed  or 
Restricted  Elevator  or  Aileron.”  This  bulletin  provided  Boeing’s  recommendations  and 
suggestions  on  how  to  implement  the  FAA’s  AD  96-26-07.^^^  With  regard  to 
uncommanded  yaw  or  roll  and  jammed  or  restricted  rudder,  Boeing’s  Operations  Manual 
Bulletin  stated  the  following: 

IJNCOMMANDED  YAW  OR  ROLL  [bold  original  to  text] 

Accomplish  this  procedure  if  uncommanded  yaw  or  roll  occurs  in 
flight. 

Maintain  control  of  the  airplane  with  all  available  flight  controls.  If  roll 
is  uncontrollable,  immediately  reduce  pitch/angle  of  attack  and 
increase  airspeed.  Do  not  attempt  to  maintain  altitude  until  control  is 


recovered. 

AUTOPILOT  (if  engaged) . DISENGAGE 

AUTOTHROTTLE  (if  engaged) . DISENGAGE 

Verify  thrust  is  symmetrical. 

If  vaw  or  roll  continues: 

YAW  DAMPER  SWITCH . OFF 


If  it  is  confirmed  that  the  autopilot  or  autothrottle  is  not  the  cause  of  the 
uncommanded  yaw  or  roll,  the  autopilot  and  autothrottle  may  be 
re-engaged  at  the  pilot’s  discretion. 

lAMMFD  OR  RESTRICTED  RUDDER  [bold  original  to  text] 

This  procedure  is  accomplished  only  after  establishing  control  of  the 
airplane  with  all  available  flight  controls  and  when  the  rudder  pedals 
are  jammed  or  deflected  in  one  direction  and  will  not  move  to  the 


pilot’s  commanded  position. 

AUTOPILOT  (if  engaged) . DISENGAGE 

AUTOTHROTTLE  (if  engaged) . DISENGAGE 

Verify  thrust  is  symmetrical. 

RUDDER  PEDALS . OVERPOWER 


According  to  Boeing,  similar  bulletins  were  issued  to  other  operators  of  the  737. 
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Identify  rudder  pedal  position  and  then  use  maximum  rudder  pedal 
force,  including  a  combined  effort  of  both  pilots  oh  the 
corresponding  rudder  pedal,  to  free  and/or  center  the  rudder. 

If  rudder  pedals  are  centered: 

Accomplish  Normal  DESCENT-APPROACH  and  LANDING 
checklists. 

Note:  Rudder  authority  may  be  limited.  Crosswind  capability  may 
be  reduced.  Do  not  use  auto  brakes.  Landing  roll  steering  may 
require  differential  braking. 

If  rudder  pedals  do  not  center  and  are  verified  to  be  jammed: 

SYSTEM  B  FLIGHT  CONTROL  SWITCH . STBY  RUD 

Apply  pedal  force  to  center  the  rudder. 

If  rudder  pedals  can  be  centered: 

Accomplish  Normal  DESCENT-APPROACH  and  LANDING 
Checklists. 

Note:  Rudder  authority  may  be  limited.  Crosswind  capability 
may  be  reduced.  Do  not  use  auto  brakes.  Landing  roll  steering 
may  require  differential  braking. 

If  rudder  pedals  will  not  center: 

SYSTEM  A  FLIGHT  CONTROL  SWITCH . OFF 

If  rudder  pedals  can  be  centered: 

ACCOMPLISH  JAMMED  OR  RESTRICTED  RUDDER  DESCENT- 
APPROACH  and  LANDING  Checklists. 

If  rudder  pedals  will  not  center: 

SYSTEM  B  FLIGHT  CONTROL  SWITCH . OFF 

DESCENT-APPROACH  [bold  original  to  text] 

Ailerons  and  elevator  are  controlled  manually.  Rudder  is  inoperative  if 
all  flight  control  switches  are  off. 

Land  at  the  nearest  suitable  airport. 

Use  longest  runway  with  minimum  crosswind. 

Plan  a  flaps  15  landing. 

Set  V^gf  15  [reference  airspeed  for  approach  with  flaps  15  setting]. 


ANTI-ICE 


AS  REQUIRED 
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AIR  CONDITIONING  AND  PRESSURIZATION . SET 

ALTIMETERS  &  INSTRUMENTS  ....SET  &  CROSSCHECKED 

N1  AND  IAS  [indicated  airspeed]  BUGS . CHECKED 

&  SET,  15 

GND  PROX  SWITCH  (As  installed) . FLAP/GEAR  INHIBIT 

GO- AROUND  PROCEDURE . REVIEW 

Accomplish  normal  go-around  procedure.  Advance  thrust  to 
go-around  smoothly  and  slowly  to  avoid  excessive  pitch-up. 

LANDING  [bold  original  to  text] 


ENGINE  START  SWITCHES . ON 

RECALL . CHECKED 


SPEEDBRAKE . ARMED,  GREEN  LIGHT 

LANDING  GEAR . DOWN,  3  GREEN 

flaps . 15,  GREEN  LIGHT 

Ground  and  flight  spoilers,  nose  steering  wheel,  wheel  brakes  and 
reverse  thrust  are  still  operative.  Landing  roll  steering  may  require 
differential  braking.  Do  not  use  auto  brakes. 

Additionally,  in  July  1997,  Boeing  published  a  Flight  Operations  Review  article, 
entitled  “737  Directional  Control.”  The  article  indicated  that  Boeing  continued  to  receive 
questions  from  pilots  about  the  likelihood  of  737  rudder  malfunctions,  the  effect  of 
potential  rudder  malfunctions  on  flightpath  control,  the  meaning  of  crossover  airspeed, 
and  the  benefit  of  increased  flap  maneuvering  speeds  on  the  crossover  airspeed.  Boeing 
stated  that  it  published  the  article  “to  address  these  issues,  to  assure  pilots  that  the  737  is 
controllable  during  a  yaw  and  roll  event  and  provide  a  recovery  technique  in  case  an 
uncommanded  yaw  or  roll  results  in  an  airplane  upset.” 

The  article  addressed  likely  and  unlikely  causes  of  737  yaw  and  roll  events, 
procedural  revisions  contained  in  the  FAA’s  AD  96-26-07,  the  FAA’s  flight  and  ground 
validation  testing  for  the  AD-related  revisions,  procedures  for  recovery  from  737  yaw  and/or 
roll  events,  and  crossover  airspeed.  The  article  stated  that: 

...the  vast  majority  [of  yaw  and/or  roll  events]  were  caused  by  external 
sources  such  as  wake  vortices,  turbulence  and  wind  shear,  or  internal 
airplane  sources  such  as  yaw  damper,  autopilot  and  autothrottle 
malfunctions,  asymmetric  flaps/slats,  and  pilot  inputs.  Additionally, 
analysis  and  testing  have  shown  that  it  is  hypothetically  possible,  although 
highly  unlikely,  that  if  one  of  the  following  rudder  malfunctions  occurs, 
yaw  and  then  roll  would  result: 
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1.  Rudder  Power  Control  Unit  (PCU)  valve  secondary  slide  jam  off- 
neutral  and  a  rudder  pedal  input  causing  full  rudder  reversal. 

2.  Jams  of  both  primary  and  secondary  slides  in  the  rudder  PCU  valve. 

3.  Standby  rudder  actuator  galling  causing  a  rudder  offset. 

4.  Linkage  Jam  causing  blockage  of  the  feedback  loop  of  the  main  PCU, 
resulting  in  uncommanded  rudder  motion. 

5.  A  foreign  object  (e.g.,  screwdriver,  wrench,  nut  or  bolt)  located 
somewhere  between  the  rudder  pedals  and  the  PCU  causing  a  rudder 
system  jam. 

Note:  The  rudder  pedals  will  always  follow  the  direction  of  the  rudder 
during  these  conditions. 

Boeing’s  article  defined  crossover  airspeed  as  the  speed  below  which  the  rolling 
moment  created  by  a  full  lateral  control  input  will  not  overcome  the  roll  effect  from  full 
rudder  displacement.  The  article  stated  that  “while  the  airspeed  at  which  this  occurs  is 
variable,  cross-over  speeds  exist  on  all  commercial  airplanes.  ...the  [737]  ‘cross-over 
speed’  is  at  or  above  [Boeing’s  recommended]  block  maneuvering  speeds^’^  at  high  gross 
weights  and  for  flaps  up  through  10.  For  flaps  15,  25,  30,  or  40,  the  ‘cross-over  speed’ 
occurs  significantly  below  recommended  block  maneuvering  speeds  and  is  near  or  below 
stick  shaker  speeds.” 

According  to  the  article,  some  737  operators  had  chosen  to  increase  their 
maneuvering  speeds  for  flaps  up  through  flaps  10  configurations  by  adding  10  knots 
above  the  block  maneuvering  speeds.  Boeing  stated  that  it  had  no  technical  objection  to 
such  an  increase  and  acknowledged  that  a  block  speed  increase  would  provide  a  marginal 
increase  in  lateral  (roll)  control  authority  relative  to  directional  control  authority. 
However,  the  article  cautioned  operators  that  the  crossover  airspeeds  “vary  as  a  function 
of  left  and  right  sideslip,  differences  in  thrust,  and  differences  in  trim.”  The  article  also 
stated  that  “relying  on  speed  additives. .  .is  simply  not  as  effective”  as  executing  a  recovery 
procedure  in  which  the  angle-of-attack  is  reduced,  airspeed  is  increased,  and  full  control 
inputs  are  made  “expeditiously.” 

Boeing’s  article  stressed  prioritizing  roll  control  during  recovery  from  nose-down 
bank  upsets  unless  the  airplane  was  in  a  stall  condition;  if  the  airplane  was  stalled,  Boeing 


Boeing  stated  that  it  has  published  block  maneuvering  speeds  for  the  737  since  the  -100  model  began 
service.  The  recommended  maneuvering  speeds  for  each  flap  configuration  provided,  for  all  airplane 
weights,  adequate  airspeed  for  maneuvering  in  at  least  a  40°  bank  without  activation  of  the  stickshaker. 
“Block”  referred  to  the  simplification  of  the  airspeed  schedule  with  regard  to  airplane’s  weight.  A  single 
airspeed  was  specified  for  all  airplane  weights  less  than  117,000  pounds;  thus,  airplanes  operating  at  weights 
less  than  117,000  pounds  (including  the  USAir  427  accident  airplane)  had  a  greater  maneuvering  margin. 
Alternative  minimum  maneuvering  speed  schedules  were  used  by  some  air  carriers  at  their  option.  These 
specified  a  minimum  airspeed  for  each  flap  configuration  and  weight  (in  10,000-pound  increments).  For 
airplanes  operating  at  weights  less  than  117,000  pounds,  these  airspeeds  were  slower  than  the  block 
maneuvering  speeds.  According  to  Boeing,  even  though  block  maneuvering  speeds  were  recommended,  it 
calculated  and  provided  alternative  minimum  maneuvering  speed  schedules  at  air  carriers’  request. 
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recommended  recovering  from  the  stall  before  recovering  from  the  upset.  The  article 
described  the  nose-down  upset  recovery  technique  as  follows: 

•  Reduce  angle  of  attack.  This  unloads  the  wing,  allows  the  airplane  to 
accelerate,  which  reduces  rudder  deflection  and  improves  lateral  control 
ability. 

•  Roll  wings  level  using  all  available  flight  controls.  This  significantly  reduces 
the  chance  of  accelerated  stall. 

•  Apply  up  elevator  to  recover  toward  the  desired  pitch  attitude  and  airspeed. 
Always  respect  the  stick  shaker,  even  in  a  nose  low  situation.  We  do  not 
suggest  using  asymmetric  thrust  to  recover  from  a  large  bank  angle  upset. 

The  article  specifically  stated  that  if  roll  was  uncontrollable,  the  pilot  should 
immediately  reduce  the  airplane’s  pitch  attitude/angle-of-attack  and  increase  airspeed; 
pilots  were  cautioned  not  to  attempt  to  maintain  altitude  until  control  was  recovered.  In 
addition,  Boeing’s  article  urged  pilots  to  “use  and  hold”  full  lateral  control  input  to  counter 
the  roll  (with  coordinated  rudder  for  bank  angles  of  45°  or  greater).  The  article  further 
stated  that  “under  all  situations,  respect  the  stick  shaker”  [underscore  original  to  text]. 

1.18.10.2.3.1  Implementation  of  AD  96-26-07  and  Boeing  737  Operations 
Manual  Revision  by  U.S.  737  Air  Carrier  Operators 

During  July  1998,  the  Safety  Board  assessed  the  implementation  of  AD  96-26-07 
by  U.S.  737  air  carrier  operators.  Of  the  13  air  carriers  contacted  by  the  Safety  Board,  12 
provided  the  requested  information.  These  12  air  carriers  operated  a  total  of  1,070 
Boeing  737s. 

The  assessment  results  indicated  that  six  of  the  responding  air  carriers  (accounting 
for  88  percent  of  the  airplanes)  were  providing  737  flight  crews  with  a  flight  simulator 
demonstration  of  crossover  airspeed  (the  overpowering  of  roll  flight  controls  by  rudder 
input.)  Four  of  these  six  air  carriers  (accounting  for  72  percent  of  the  airplanes)  were 
providing  flight  crews  a  specific  demonstration  of  the  crossover  airspeed  in  the  flaps  1 
configuration.  However,  six  air  carriers  (accounting  for  12  percent  of  the  airplanes)  had  no 
documented  simulator  training  on  crossover  airspeed. 

According  to  the  assessment  information,  8  of  the  12  responding  air  carriers 
provided  simulator  training  to  flight  crews  on  the  jammed  rudder  procedure,  but  the 
remaining  4  (accounting  for  20  percent  of  the  airplanes)  provided  no  simulator  training  on 
this  procedure.  Of  the  eight  air  carriers  that  trained  crews  on  the  jammed  rudder 
procedure,  five  (accounting  for  40  percent  of  the  airplanes)  required  instructors  to 
continue  the  procedure  at  least  to  the  step  of  selecting  the  hydraulic  system  B  flight 
control  switch  to  the  standby  rudder  position.  The  remaining  three  air  carriers  that  trained 
crews  on  the  jammed  rudder  procedure  (accounting  for  40  percent  of  the  airplanes)  did  not 
specify  the  extent  to  which  the  procedure  was  to  be  performed  or  terminated  the  procedure 
to  respond  to  a  jammed  rudder  malfunction  with  disengagement  of  the  yaw  damper. 
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The  assessment  results  also  indicated  that  10  of  the  12  air  carriers  had 
implemented  a  minimum  maneuvering  airspeed  for  the  flaps  1  configuration  (110,000- 
pound  airplane  gross  weight)  of  at  least  190  knots.  Four  of  these  10  air  carriers 
(accounting  for  66  percent  of  the  airplanes)  had  increased  Boeing’s  recommended  block 
maneuvering  speeds  by  10  knots  and  were  requiring  pilots  to  use  at  least  200  knots  as  the 
minimum  airspeed  for  flaps  1.  The  remaining  two  air  carriers  were  using  slower  minimum 
maneuvering  speeds  specified  for  each  10,000-pound  increment  of  airplane  weight.  For 
flaps  1  and  a  110,000-pound  airplane  gross  weight,  these  two  carriers  (accounting  for  a 
combined  total  of  16  of  the  airplanes)  were  using  minimum  block  maneuvering  speeds  of 
158  and  164  knots. 

Further,  the  assessment  indicated  that  all  responding  air  carriers  had  modified  the 
checklist  for  “Uncommanded  Yaw  and  Roll”  in  accordance  with  AD  96-26-07  and  the 
February  17, 1997,  Boeing  Operations  Manual  Bulletin.  These  modifications  included  the 
bulletin’s  requirement  for  pilots  to  recall  from  memory  the  procedure  to  disengage  the 
yaw  damper  in  the  event  of  an  uncommanded  yaw  or  roll. 

1.18.10.2.4  Safety  Board  Recommendations  Relating  to  Unusual  Attitude 
Training 

During  its  investigation  of  the  USAir  flight  427  accident,  the  Safety  Board  issued 
Safety  Recommendations  A-96-118,  A-96-120,  and  A-97-18  regarding  unusual  attitude 
procedures  and  training.  In  its  February  2,  1999,  letter  to  the  FAA,  the  Safety  Board 
indicated  that  Safety  Recommendations  A-96-118  and  A-97-18  were  classified  “Open — 
Unacceptable  Response”  and  that  Safety  Recommendation  A-96-120  was  classified 
“Open — Acceptable  Response.”  The  letter  also  stated  that  the  Board  would  further  discuss 
and  analyze  these  recommendations  in  the  USAir  flight  427  accident  report.  The  histories 
of  Safety  Recommendations  A-96-118,  A-96-120,  and  A-97-18  are  discussed  in  sections 
1.18.11.5  and  1.18.11.6  and  analyzed  in  section  2.7. 

1.18.11  History  of  Safety  Recommendations  Resulting  From  the 
United  Flight  585  and  USAir  Flight  427  Accidents  and  the 
Eastwind  Flight  517  Incident 

The  Safety  Board  made  27  safety  recommendations  as  a  result  of  its  investigation 
of  the  United  flight  585  and  USAir  flight  427  accidents,  the  Eastwind  flight  517  incident, 
and  other  occurrences  involving  737  series  airplanes.  A  listing  of  these  safety 
recommendations  appears  in  sections  1.18.11.1  through  1.18.11.6. 

1.18.11.1  Galling  of  Standby  Rudder  Actuator  Bearings— United  Flight  585 
Accident  (Safety  Recommendation  A-91-77) 

During  its  investigation  of  the  accident  involving  United  flight  585,  the  Safety 
Board  became  concerned  about  galled  standby  rudder  actuator  bearings  on  737s  and  727s. 
As  a  result,  the  Safety  Board  issued  Safety  Recommendation  A-91-77  on  August  20, 
1991. 
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Safety  Recommendation  A-91-77  asked  the  FAA  to 

Issue  an  airworthiness  directive  requiring  a  check  on  all  Boeing  737  and  727 
model  airplanes  with  the  part  number  (P/N)  1087-23  input  shaft  in  the 
rudder  auxiliary  actuator  unit  for  the  force  needed  to  rotate  the  input  shaft 
lever  relative  to  the  P/N  1087-22  bearing  of  the  auxiliary  actuator  unit. 

During  this  check,  the  bearing  should  be  inspected  to  determine  if  it  rotates 
relative  to  the  housing.  All  shaft  assemblies  in  which  rotation  of  the  bearing 
occurs,  or  in  which  excessive  force  is  needed  to  move  the  input  lever,  should 
be  removed  from  service  on  an  expedited  basis,  and  the  assemblies  should 
be  replaced  with  a  P/N  1087-21  shaft  assembly  that  has  a  reduced  diameter 
on  the  unlubricated  portion  of  the  shaft  in  accordance  with  revision  G  of  the 
P/N  1087-23  engineering  drawing.  All  assemblies  meeting  the  force 
requirement  should  be  rechecked  at  appropriate  intervals  until  replaced  with 
a  P/N  1087-21  shaft  assembly  containing  a  P/N  1087-23  shaft  that  has  a 
reduced  diameter  on  the  unlubricated  portion  of  the  shaft. 

On  January  3,  1992,  the  FAA  issued  an  NPRM  (Docket  No.  91-NM-257-AD)  in 
response  to  this  recommendation.  The  NPRM  proposed  to  adopt  an  AD  that  would  require 
inspecting  the  input  shaft  in  the  auxiliary  (standby)  rudder  PCU  on  all  727  series  and 
certain  737  series  airplanes  and  reporting  to  the  FAA  on  those  units  that  failed  the 
inspection  test  procedure. 

In  a  March  27,  1992,  letter,  the  Safety  Board  expressed  concern  that  an  inspection 
of  the  standby  rudder  actuator  bearings  was  not  included  in  the  NPRM.  Because  loose 
bearings  can  indicate  a  galling  problem,  the  Safety  Board  believed  that  inspection  of  the 
bearings  for  rotation  in  the  housing  and  for  the  integrity  of  the  safety  wire  was  essential. 
The  Safety  Board  was  also  concerned  that  the  proposed  time  for  compliance  for  these 
inspections  (4,000  flight  hours)  might  be  excessive.  As  the  FAA  indicated  in  the  NPRM, 
the  tests  and  inspections  would  only  take  about  6  hours.  Because  of  the  possibility  that  the 
components  affected  could  cause  an  uncommanded  rudder  input,  the  Safety  Board 
believed  that  these  inspections  should  be  performed  as  soon  as  possible  or,  at  the  very 
least,  at  the  next  available  inspection  of  the  airplane. 

After  the  NPRM  was  issued,  the  FAA  determined  that  the  condition  addressed  in 
the  NPRM  was  not  unsafe  and  did  not  warrant  the  issuance  of  an  AD.  Consequently,  on 
April  19, 1993,  the  FAA  issued  a  notice  in  the  Federal  Register  to  withdraw  the  NPRM.  In 
an  August  5,  1993,  letter  to  the  Safety  Board,  the  FAA  indicated  that  it  withdrew  the 
NPRM  based  on  its  reevaluation  of  the  design  of  the  rudder  control  system  on  the  727  and 
737  series  airplanes.  The  reevaluation  determined  that  a  flight  crew  would  be  capable  of 
detecting  a  galling  condition  by  (1)  increased  force  necessary  to  move  the  rudder  pedal, 
(2)  erratic  nose  gear  steering  with  the  yaw  damper  engaged,  (3)  rudder  yaw  damper  kick 
back  or  yaw  damper  back  drives  on  the  rudder  pedals  during  flight,  and  (4)  erratic 
operation  of  the  rudder  yaw  damper  or  erratic  rudder  oscillations  with  the  yaw  damper 
engaged.  The  FAA  concluded  that  none  of  these  indications  of  galling  represented  a  safety 
hazard. 


On  November  15,  1993,  the  Safety  Board  acknowledged  the  results  of  the  FAA’s 
reevaluation  of  the  design  of  the  rudder  control  system  on  727  and  737  airplanes.  The 
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Safety  Board  did  express  concern,  however,  that  the  galling  could  result  in  erratic  flight 
control,  distract  a  flight  crew,  and  be  potentially  hazardous  in  certain  circumstances. 
Because  the  Board  stated  that  it  had  no  further  evidence  that  galling  could  result 
uncommanded  rudder  deflections  of  a  significant  magnitude.  Safety  Recommendation 
A-91-77  was  classified  “Closed — Acceptable  Alternate  Action.” 

1.18.11.2  Weather-Related  Recommendations — United  Flight  585  Accident 
(Safety  Recommendations  A-92-57  and  -58) 

As  a  result  of  information  developed  during  the  accident  investigation  of  United 
Airlines  flight  585,  the  Safety  Board  issued  Safety  Recommendations  A-92-57  and  -58  on 
July  20, 1992. 

Safety  Recommendation  A-92-57  asked  the  FAA  to 

Develop  and  implement  a  meteorological  program  to  observe,  document, 
and  analyze  potential  meteorological  aircraft  hazards  in  the  area  of 
Colorado  Springs,  Colorado,  with  a  focus  on  the  approach  and  departure 
paths  of  the  Colorado  Springs  Municipal  Airport.  This  program  should  be 
made  operational  by  the  winter  of  1992. 

Safety  Recommendation  A-92-58  asked  the  FAA  to 

Develop  a  broader  meteorological  aircraft  hazard  program,  to  include  other 
airports  in  or  near  mountainous  terrain,  based  on  the  results  obtained  in  the 
Colorado  Springs,  Colorado,  area. 

On  October  8,  1992,  the  FAA  stated  that  its  Research  and  Development  Service 
was  planning  to  start  a  program  in  fiscal  year  1995  to  address  potential  aircraft  hazards 
resulting  from  mountain-induced  meteorological  phenomena.  On  March  26,  1993,  the 
FAA  indicated  that  the  Research  and  Development  Service  was  planning  to  accelerate 
program  implementation  to  fiscal  year  1994.  On  June  10, 1993,  the  Safety  Board  indicated 
that  it  was  pleased  with  the  FAA’s  accelerated  program  because  the  Board  was 
investigating  four  accidents  in  which  mountain-induced  meteorological  phenomena  might 
have  been  a  cause  or  factor.  On  September  14,  1993,  the  FAA  indicated  that  it  had  tasked 
NOAA’s  Forecast  Systems  Laboratory  to  (1)  formulate  a  plan  to  provide  a  definitive  study 
of  mountain-induced  wind  phenomena  and  their  effect  on  aircraft  in  flight  and  (2)  develop 
initiatives  to  define  and  implement  a  program  to  alert  pilots  of  these  hazards. 

On  December  14,  1995,  the  FAA  indicated  that,  in  September  1995,  the  FAA/ 
NOAA  program  was  redefined  in  scope  because  of  reduced  budget  allocations  and 
expected  future  funding  constraints.  As  a  result,  the  FAA  planned  to  complete  (1)  a  pilot 
training  manual  on  the  impact  of  mountain-induced  aeronautical  hazards  on  aircraft 
operations;  (2)  a  Colorado  Springs  data  collection  and  baseline  experiment  for  a  terminal 
area  detection  system  for  mountain-induced  turbulence  hazards;  and  (3)  a  final  report  with 
recommendations  from  this  experiment  on  the  viability  of  developing  a  prototype 
prediction,  detection,  and  display  system  for  these  hazards  in  the  terminal  area.  The  FAA 
reported  that  it  had  drafted  the  training  manual. 
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On  March  20,  1996,  the  Safety  Board  indicated  that  the  FAA’s  draft  pilot  training 
manual  was  very  comprehensive  and  detailed.  However,  the  Safety  Board  expressed 
concern  that  funding  constraints  had  reduced  the  scope,  duration,  and  rigor  of  the 
originally  proposed  data  collection  experiment.  The  Board  urged  the  FAA  to  increase 
funding  for  the  program. 

On  April  3,  1998,  the  FAA  stated  that  it  had  completed  several  actions  to  improve 
the  safety  of  flying  in  mountainous  areas  “by  providing  pilots,  dispatchers,  and  others  in 
aviation  operations  with  a  series  of  products  that  will  detect,  display,  and  forecast 
hazardous  mountain  winds.”  The  letter  stated  that  the  FAA  had  accomplished  the 
following: 


•  The  FAA,  NOAA,  and  NCAR  published  AC  00-57,  "Hazardous  Mountain 
Winds  and  Their  Visual  Indicators,"  to  provide  information  on  hazardous 
mountain  winds  and  their  effects  on  flight  operations  near  mountainous 
regions.  The  primary  purpose  of  the  AC  is  to  assist  pilots  involved  in  aviation 
operations  in  diagnosing  the  potential  for  severe  wind  events  in  the  vicinity  of 
mountainous  areas  and  provide  information  on  preflight  planning  techniques 
and  in-flight  evaluation  strategies  for  avoiding  destructive  turbulence  and  loss 
of  aircraft  control. 

•  NOAA  and  NCAR  personnel  collected  data  on  the  intensity  and  direction  of 
wind  flows  at  the  Colorado  Springs  Airport  during  January  through  March 
1997,  when  mountain-induced  activity  was  known  to  be  prevalent.  A  data  set 
was  developed  through  the  use  of  one  Doppler  Light  Distancing  and  Ranging 
(LIDAR)  unit,  three  wind  profilers  with  radio  acoustic  sounding  system, 
anemometers,  an  instrumented  King  Air  airplane  that  traversed  the  landing  and 
takeoff  flightpaths,  six  surface  meteorological  stations,  an  infrasonic 
laboratory,  and  pilot  reports.  NOAA  and  NCAR  were  expected  to  complete  a 
report  by  September  1998  on  a  limited  analysis  of  the  Colorado  Springs  data. 
The  analysis  was  to  assess  the  turbulence-detection  capabilities  of  the  LIDAR 
and  ground  anemometers  and  determine  the  strengths  of  LIDAR-detected  wind 
turbulence  as  a  function  of  other  factors  that  were  recorded  during  the 
experiment. 

On  January  20,  1999,  the  Safety  Board  stated  that  the  data  collected  during  the 
Colorado  Springs  meteorological  program  in  early  1997  represented  an  important  and 
somewhat  unique  data  set  that  defined  mountain-induced  wind  flows  and  the  associated 
hazards.  The  Board  urged  the  FAA  to  make  every  effort  to  ensure  the  complete  and 
detailed  analysis  of  these  data  and  the  timely  publication  of  the  results.  Pending  the 
issuance  of  a  final  report  by  NOAA  and  NCAR,  Safety  Recommendation  A-92-57  was 
classified  “Open — Acceptable  Response.”  However,  the  Safety  Board  still  believed  that 
the  FAA  should  develop  a  broader  meteorological  aircraft  hazard  program  to  include 
airports  (other  than  Colorado  Springs)  in  or  near  mountainous  areas.  Pending  receipt  of 
information  on  such  a  program.  Safety  Recommendation  A-92-58  was  classified  “Open 
Unacceptable  Response.” 
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1.18.11.3  Recommendations  Resulting  From  the  July  1992  United  Airlines 
Ground  Check  PCU  Anomaly  (Safety  Recommendations  A-92-118 
Through  -121) 

On  July  16,  1992,  during  a  preflight  check  of  the  flight  controls  in  a  United 
Airlines  737-300  that  was  taxiing  to  takeoff  from  ORD,  the  captain  discovered  that  the 
airplane's  rudder  pedal  stopped  at  around  25  percent  left  pedal  travel.  The  airplane 
returned  to  the  gate,  and  the  main  rudder  PCU  (S/N  2228A)  was  removed.  Subsequent 
testing  indicated  that,  when  the  input  crank  was  fixed  against  the  body  stops  (to  simulate  a 
jam  of  the  primary  slide  to  the  secondary  slide)  and  the  yaw  damper  piston  was  in  the 
extend  position,  the  PCU  servo  valve  exhibited  anomalous  actions,  ranging  from  sluggish 
movement  of  the  actuator  piston  to  a  full  reversal  in  the  direction  of  piston  travel  opposite 
to  the  direction  being  commanded. 

As  a  result  of  this  and  other  incidents  involving  anomalies  in  the  737  rudder 
system,  the  Safety  Board  issued  Safety  Recommendations  A-92-118  through  -121  on 
November  10, 1992. 

Safety  Recommendation  A-92-118  asked  the  FAA  to 

Require  that  Boeing  develop  a  repetitive  maintenance  test  procedure  to  be 
used  by  737  operators  to  verify  the  proper  operation  of  the  main  rudder 
power  control  unit  servo  valve  until  a  design  change  is  implemented  that 
would  preclude  the  possibility  of  anomalies  attributed  to  overtravel  of  the 
secondary  slide. 

On  January  19,  1993,  the  FAA  stated  that  Boeing  would  issue  service  information 
to  inspect  and  retrofit  all  737  series  airplanes.  The  FAA  also  stated  that  it  would  issue  an 
NPRM  to  mandate  compliance  with  this  information.  On  January  3, 1994,  the  FAA  issued 
AD  94-01-07,  which  became  effective  on  March  3,  1994.  The  AD  required,  within  750 
flight  hours  after  its  effective  date,  (1)  repetitive  tests  of  the  main  rudder  PCU  of  certain 
737  series  airplanes,  in  accordance  with  Boeing  SL  737-SL-27-82-B,  to  detect  excessive 
internal  leakage  of  hydraulic  fluid,  stalling,  or  reversal  and  (2)  the  eventual  replacement  of 
the  main  rudder  PCU  with  an  improved  model  incorporating  a  redesigned  servo  valve. 

In  an  August  11,  1994,  letter  to  the  FAA,  the  Safety  Board  stated  that,  in  the 
interest  of  safety,  all  737  main  rudder  PCUs  should  be  modified  at  the  earliest  possible 
date  and  that  the  compliance  period  in  AD  94-01-07  appeared  to  be  founded  on  reasonable 
estimates  of  equipment  availability.  Because  the  AD  met  the  intent  of  the  Safety 
Recommendation  A-92-118,  it  was  classified  “Closed — Acceptable  Action.” 

Safety  Recommendation  A-92-119  asked  the  FAA  to 

Require  that  Boeing  develop  an  approved  preflight  check  of  the  rudder 
system  to  be  used  by  operators  to  verify,  to  the  extent  possible,  the  proper 
operation  of  the  main  rudder  power  control  unit  servo  valve  until  a  design 
change  is  implemented  that  would  preclude  the  possibility  of  rudder 
reversals  attributed  to  the  overtravel  of  the  secondary  slide. 
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On  January  19,  1993,  the  FAA  responded  that  it  did  not  agree  with  this  safety 
recommendation  because  it  believed  that  the  current  preflight  check  procedures 
adequately  ensured  proper  rudder  operation.  On  June  10,  1993,  the  Safety  Board  indicated 
that  rapid  rudder  pedal  inputs  were  required  to  induce  the  lockup  that  occurred  during  the 
July  16,  1992,  preflight  check  conducted  by  the  captain  of  the  United  Airlines  737-300 
and  that  a  routine  preflight  check  would  not  have  uncovered  the  problem.  In  all  test  cases 
that  resulted  in  the  locked-up  condition  or  reversal,  the  input  control  was  moved  at  a  rate 
faster  than  the  rudder  actuator  could  respond,  thus  forcing  the  secondary  valve  into  the 
overtravel  position.  The  Safety  Board  further  stated  that  rapid  movement  of  the  rudder 
pedals  on  the  ground  could  result  in  damage  to  the  airplane. 

In  a  July  14,  1994,  letter,  the  FAA  reiterated  its  position  that  current  preflight 
check  procedures  adequately  ensure  proper  rudder  operation.  The  FAA  agreed  that  rapid 
rudder  inputs  were  a  factor  in  uncovering  rudder  control  anomalies  and  that  a  rapid  rudder 
input  during  every  preflight  check  increased  the  possibility  of  structural  rudder  damage. 
The  FAA  also  stated  that  it  would  be  impossible  to  conduct  this  check  with  any  degree  of 
consistency  because  of  variances  among  pilots.  Finally,  the  FAA  stated  that  not  all  rudder 
control  anomalies  resulting  from  secondary  slide  overtravel  can  be  detected  during 
preflight  checks. 

Instead  of  incorporating  rapid  rudder  movements  in  the  preflight  check,  the  FAA 
included  specific  requirements  in  AD  94-01-07  for  a  periodic  (750  flight  hours)  inspection 
of  the  rudder  system  until  the  servo  valve  was  redesigned.  The  AD  required  that  the  rudder 
pedals  be  cycled  at  the  maximum  rate  and  that  special  instrumentation  and  additional 
observers  be  available  to  properly  detect  any  anomaly.  According  to  the  FAA,  the 
requirements  of  the  AD  were  intended  to  ensure  the  detection  of  high  internal  leakage 
within  the  main  rudder  PCU  servo  valve,  which  is  a  symptom  of  secondary  slide 
overtravel.  The  inspection  was  expected  to  identify  servo  valves  that  performed 
marginally  by  measuring  the  internal  leakage  rate.  The  FAA  stated  that  a  servo  valve  with 
marginal  performance  would  not  be  detected  during  a  preflight  check  but  would  have  a 
reduced  hinge  moment  capability  because  of  excessive  internal  leakage.  This  internal 
leakage  rate  cannot  be  measured  during  a  preflight  check. 

On  August  11,  1994,  the  Safety  Board  notified  the  FAA  that  the  requirement  for 
repetitive  inspections  of  the  main  rudder  PCU  at  750-hour  intervals  was  sufficient. 
Because  the  FAA’s  action  addressed  the  intent  of  Safety  Recommendation  A-92-119,  it 
was  classified  “Closed — Acceptable  Alternate  Action.” 

Safety  Recommendation  A-92-120  asked  the  FAA  to 

Require  operators,  by  airworthiness  directive,  to  incorporate  design 
changes  for  the  737  main  rudder  power  control  unit  servo  valve  when  these 
changes  are  made  available  by  Boeing.  These  changes  should  preclude  the 
possibility  of  rudder  reversals  attributed  to  the  overtravel  of  the  secondary 
slide. 
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On  January  3,  1994,  the  FAA  issued  AD  94-01-07  (see  A-92-118).  On  August  11, 
1994,  the  Safety  Board  stated  that,  because  the  AD  satisfied  the  intent  of  Safety 
Recommendation  A-92-120,  it  was  classified  “Closed— Acceptable  Action.” 

Safety  Recommendation  A-92-121  asked  the  FAA  to 

Conduct  a  design  review  of  servo  valves  manufactured  by  Parker  Hannifin 
having  a  design  similar  to  the  737  rudder  power  control  unit  servo  valve 
that  control  essential  flight  control  hydraulic  power  control  units  on 
transport-category  airplanes  certified  by  the  Federal  Aviation 
Administration  to  determine  that  the  design  is  not  susceptible  to  inducing 
flight  control  malfunctions  or  reversals  due  to  overtravel  of  the  servo 
slides. 

On  January  19,  1993,  the  FAA  stated  that  a  design  review  of  the  servo  valves 
manufactured  by  Parker  Hannifin  on  all  transport-category  airplanes  was  completed.  The 
problem  was  found  to  exist  in  the  main  rudder  PCU  only  on  737  airplanes.  On  June  10, 
1993,  the  Safety  Board  responded  that,  because  this  information  met  the  intent  of  Safety 
Recommendation  A-92-121,  it  was  classified  “Closed — Acceptable  Action.” 

1.18.11.4  Flight  Data  Recorder  Recommendations  (Safety 
Recommendations  A-95-25  Through  -27) 

The  FDRs  on  the  airplanes  involved  in  the  United  flight  585  and  USAir  flight  427 
accidents  recorded  very  limited  amounts  of  data.  The  FDR  installed  on  the  United  airplane 
recorded  data  for  five  parameters.  (For  more  information,  see  section  1.16.1.1.)  The  FDR 
installed  on  the  USAir  airplane  recorded  data  for  13  parameters.^^'^  (For  more  information, 
see  section  1.11.2.)  However,  neither  FDR  recorded  other  parameters  that  would  have 
been  useful  in  these  accident  investigations,  including  control  wheel  position,  rudder 
pedal  position,  flight  control  surface  (rudder,  aileron,  and  spoiler)  positions,  or  lateral 
acceleration.  As  a  result  of  its  concerns  about  limited-parameter  PDRs,  the  Safety  Board 
issued  Safety  Recommendations  A-95-25  through  -27  on  February  22, 1995. 

Safety  Recommendation  A-95-25,  which  was  designated  as  urgent,  asked  the  FAA  to 

Require  that  each  Boeing  737  airplane  operated  under  14  CFR  Parts  121  or 
125  be  equipped,  by  December  31, 1995,  with  a  flight  data  recorder  system 
that  records,  at  a  minimum,  the  parameters  required  by  current  regulations 
applicable  to  that  airplane  plus  the  following  parameters  (recorded  at  the 
sampling  rates  specified  in  "Proposed  Minimum  FDR  Parameter 
Requirements  for  Airplanes  in  Service”):  lateral  acceleration;  flight  control 
inputs  for  pitch,  roll,  and  yaw;  and  primary  flight  control  surface  positions 
for  pitch,  roll,  and  yaw. 


The  existing  regulations  at  the  time  of  the  USAir  flight  427  accident  (14  CFR  Section  121.343) 
required  that  airplanes  operated  under  Part  121  have  FDRs  that  record  11  parameters.  Title  14  Sections 
125.225  and  135.152  contained  a  similar  requirement  for  airplanes  operated  under  Parts  125  and  135, 
respectively. 
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Safety  Recommendation  A-95-26  asked  the  FAA  to 

Amend,  by  December  31  1995,  14  CFR  Sections  121.343,  125.225,  and 
135.152  to  require  that  Boeing  727  airplanes,  Lockheed  L-1011  airplanes, 
and  all  transport-category  airplanes  operated  under  14  CFR  Parts  121, 125, 
or  135,  whose  type  certificate  applies  to  airplanes  still  in  production,  be 
equipped  to  record  on  a  flight  data  recorder  system,  at  a  minimum,  the 
parameters  listed  in  "Proposed  Minimum  FDR  Parameter  Requirements  for 
Airplanes  in  Service"  plus  any  other  parameters  required  by  current 
regulations  applicable  to  each  individual  airplane.  Specify  that  the 
airplanes  be  so  equipped  by  January  1, 1998,  or  by  the  later  date  when  they 
meet  Stage  3  noise  requirements  but,  regardless  of  Stage  3  compliance 
status,  no  later  than  December  31, 1999.” 

Safety  Recommendation  A-95-27  asked  the  FAA  to 

Amend,  by  December  31,  1995,  14  CFR  Sections  121.343,  125.225,  and 
135.152  to  require  that  all  airplanes  operated  under  14  CFR  Parts  121, 125, 
or  135  (10  seats  or  larger),  for  which  an  original  airworthiness  certificate  is 
received  after  December  31,  1996,  record  the  parameters  listed  in 
“Proposed  FDR  Enhancements  for  Newly  Manufactured  Airplanes”  on  a 
flight  data  recorder  having  at  least  a  25-hour  recording  capacity. 

In  issuing  these  safety  recommendations,  the  Safety  Board  stated  that  information 
from  FDRs  with  additional  parameters  substantially  aided  its  investigations  of  two 
regional  airline  accidents.  The  first  accident,  on  February  1,  1994,  involved  a  dual-engine 
power  loss  in  a  Saab  340B  at  New  Roads,  Louisiana.^^^  The  FDR  installed  on  this  airplane 
recorded  128  parameters.  Because  of  the  expanded  FDR  data,  the  Safety  Board  was  able 
to  rule  out  early  in  the  investigation  an  airplane  system  anomaly  as  the  initiating  event  and 
focus  on  operational  and  human  performance  issues.  The  second  accident,  on  October  31, 
1994,  involved  an  uncommanded  roll  excursion  of  an  Avions  de  Transport  Regional 
Model  72-212  (ATR-72)  near  Roselawn,  Indiana.^®^  The  airplane’s  FDR  was  configured  to 
record  approximately  115  parameters.  The  volume  of  data  recorded  by  this  enhanced  FDR 
enabled  the  Board  to  narrow  the  focus  of  its  investigation  early  on  to  possible  explanations 
for  aileron  control  surface  movements.  As  a  result,  the  Safety  Board  issued,  within  days  of 
the  accident,  urgent  safety  recommendations  to  minimize  the  likelihood  of  similar 
occurrences. 

In  a  February  24,  1995,  letter,  the  FAA  stated  that  it  would  open  a  public  docket 
and  seek  comments  on  these  recommendations  and  that  it  planned  to  hold  a  public 
meeting  to  review  the  recommendations.  On  March  8,  1995,  the  Safety  Board  responded 
that  these  actions  could  create  an  unacceptable  delay  and  urged  the  FAA  to  establish  an 
accelerated  schedule  for  adopting  Safety  Recommendation  A-95-25. 


For  more  information,  see  National  Transportation  Safety  Board.  1994.  Overspeed  and  Loss  of 
Power  on  Both  Engines  During  Descent  and  Power-off  Emergency  Landing,  Simmons  Airlines,  Inc.,  d.b.a. 
American  Eagle  Flight  3641,  N349SB,  False  River  Air  Park,  New  Roads,  Louisiana,  February  1,  1994. 
Aircraft  Accident  Report  NTSB/ AAR-94/06.  Washington,  DC. 

For  more  information,  see  the  discussion  of  Safety  Recommendation  A-96-120  in  section  1.18.11.5. 
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On  May  16,  1995,  the  FA  A  indicated  that  it  agreed  with  the  intent  of  the 
recommendations  but  that  it  could  not  meet  the  December  31,  1995,  retrofit  completion 
date  in  Safety  Recommendation  A-95-25.  The  FAA  characterized  the  Safety  Board’s 
timetable  as  “an  extremely  aggressive  schedule  which,  if  it  were  physically  possible, 
would  result  in  substantial  airplane  groundings  and  very  high  associated  costs.”  On 
July  17,  1995,  the  Safety  Board  indicated  its  disappointment  that  the  recommended 
compliance  date  could  not  be  met.  The  Board  believed  that  the  date  of  compliance  for  the 
recommendation  must  reflect  the  urgency  associated  with  retrofitting  737s  to  record 
additional  FDR  parameters. 

In  an  April  29, 1996,  letter  to  the  FAA,  the  Safety  Board  pointed  out  that  more  than 
1  year  had  elapsed  since  it  issued  urgent  Safety  Recommendation  A-95-25  and  that  it  had 
been  almost  1  year  since  the  FAA  formally  responded  to  this  issue.  Also,  the  Board  said 
that  PDR  recordings  from  several  other  737s  that  reported  in-flight  disturbances  similar  to 
those  associated  with  the  United  flight  585  and  USAir  flight  427  accidents  did  not  provide 
sufficient  data  to  isolate  rudder  and  pedal  movement  primarily  because  the  flight  control 
inputs  or  control  surface  positions  were  not  recorded.  The  Board  believed  that,  if  the  FAA 
and  industry  had  begun  to  implement  Safety  Recommendation  A-95-25  after  it  was 
issued,  most  737s  would  have  been  retrofitted  with  an  acceptable,  short-term  improved 
recording  capability.  The  Safety  Board  concluded  that  the  lack  of  FAA  action  was 
unacceptable. 

In  addition,  the  Safety  Board  stated  that,  according  to  the  FAA,  the  major 
impediment  to  the  retrofit  of  737s  was  cost.  However,  Board  staff  visited  a  maintenance 
facility  to  observe  the  installation  of  FDR  sensors  and  associated  wiring  and  found  that 
industry  cost  estimates  apparently  did  not  seek  innovative  measures  that  might  reduce 
cost.  For  example,  in  the  installation  observed,  industry  assumed  that  aft  lavatories  had  to 
be  removed  to  allow  wires  to  be  routed  from  the  airplane’s  tail  to  the  FDR.  Consultations 
with  installation  experts  demonstrated  that  wiring  could  be  routed  through  existing  access 
ports  on  a  lower  portion  of  the  aft  pressure  bulkhead,  which  could  eliminate  the  need  to 
remove  the  aft  lavatory  and  save  150  hours  of  labor.  On  the  basis  of  these  consultations. 
Safety  Board  staff  believed  that  adding  rudder  pedal  and  rudder  position  sensors  to 
existing  737s  could  be  accomplished  without  interrupting  normal  revenue  service.  The 
Board  suggested  that  the  work  be  performed  on  approximately  four  to  five  overnight  visits 
or  during  a  C  maintenance  check  without  extending  the  visit. 

In  a  July  1,  1996,  letter  to  the  FAA,  the  Safety  Board  addressed  the  Eastwind  flight 
517  incident  that  had  occurred  the  previous  month.  The  Board  believed  that,  under  slightly 
different  circumstances,  the  Eastwind  incident  could  have  become  the  third  fatal  737  upset 
accident  for  which  there  was  inadequate  FDR  information  to  determine  the  cause.  The 
Board  also  believed  that,  if  the  FAA  had  complied  with  the  intent  of  Safety 
Recommendation  A-95-25,  the  Eastwind  airplane  would  have  been  fitted  with  an  FDR 
that  recorded  the  parameters  necessary  to  better  understand  the  events  leading  to  the  upset 
and  develop  corrective  actions  to  prevent  a  future  catastrophic  737  accident.  In  addition, 
the  Board  expressed  its  continued  strong  concern  about  the  failure  of  the  FAA  to  require 
the  needed  retrofit  of  the  737.  The  Board  noted  that  more  than  15  months  had  passed  with 
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no  action  taken  on  this  important  safety  issue.  As  a  result,  Safety  Recommendation 
A-95-25  had  been  placed  on  the  Safety  Board’s  Most  Wanted  Safety  Improvements 
List.^’"^  The  Board  once  again  urged  the  FAA  to  take  the  necessary  actions  to  meet  the 
intent  of  this  safety  recommendation. 

On  July  9,  1996,  the  FAA  issued  an  NPRM,  “Revisions  to  Digital  Flight  Data 
Recorder  Rules.”  The  proposed  rule  would  require  a  4-year  retrofit  of  FDR  systems,  with 
parameter  upgrade  requirements  based  on  when  the  aircraft  was  manufactured  and 
whether  the  aircraft  was  equipped  with  a  flight  data  acquisition  unit  (FDAU).^^*  The 
proposed  rule  would  also  mandate  increases  in  the  number  of  required  FDR  parameters 
for  newly  manufactured  aircraft,  with  the  first  parameter  increase  occurring  3  years  from 
the  date  of  the  final  rule  and  the  second  increase  5  years  after  the  date  of  the  final  rule. 

On  August  15,  1996,  the  Safety  Board  commented  on  the  NPRM.  The  Board 
recognized  that  the  FAA’s  proposed  revisions  attempted  to  increase  the  minimum  number 
of  FDR  parameters  and  impose  the  minimum  financial,  operational,  manufacturing,  and 
purchase  contract  burdens  on  industry.  However,  the  Board  strongly  disagreed  with  the 
FAA’s  proposed  compliance  dates  for  newly  manufactured  and  existing  aircraft  and  with 
the  minimum  parameter  requirements  for  existing  aircraft.  The  Board  also  strongly 
disagreed  with  the  FAA's  decision  not  to  require  more  expeditious  flight  control  parameter 
upgrades  for  737  airplanes.  The  Board  strongly  requested  that  the  FAA  act  on  the  Board's 
comments  to  the  NPRM  and  expedite  issuance  of  a  final  rule. 

On  October  7, 1996,  the  FAA  reiterated  the  position  presented  in  its  May  16,  1995, 
letter.  On  December  12,  1996,  the  Safety  Board  stated  that,  although  it  had  been  verbally 
informed  that  the  FAA  hoped  to  issue  a  final  rule  by  the  end  of  December  1996,  the 
October  7  letter  made  no  mention  of  an  issue  date  for  the  final  rule.  The  Board  also  stated 
that,  even  if  a  final  rule  were  issued  by  the  end  of  1996,  all  aircraft  would  not  be  required 
to  be  upgraded  until  December  2000,  almost  6  years  after  Safety  Recommendations 
A-95-25  through  -27  were  issued.  Because  of  the  FAA’s  failure  to  take  action  to  ensure 
timely  upgrades  of  the  737  FDR  parameters.  Safety  Recommendation  A-95-25  was 
classified  “Closed — ^Unacceptable  Action.” 

On  July  9,  1997,  the  FAA  issued  its  final  rule  in  response  to  the  safety 
recommendations,  which  required  in  part  that  all  existing  transport-category  airplanes 
operated  under  14  CFR  Parts  121, 125,  and  135  be  equipped  with  FDRs  that  record  at  least 
18  parameters,  instead  of  the  previously  required  11  parameters.  Also  in  its  final  rule,  the 
FAA  indicated  that  the  retrofit  modification  to  existing  airplane’s  FDRs  should  be 
accomplished  at  the  earliest  practicable  time  but  no  later  than  the  airplane’s  first  heavy 
maintenance  check  after  August  18,  1999.  In  a  July  22,  1997,  letter,  the  FAA  stated  that 


The  Safety  Board’s  Most  Wanted  Safety  Improvements  List  contains  the  agency’s  10  most  urgent 
safety  recommendation  issues  in  the  areas  of  aviation,  highway,  pipeline  and  hazardous  materials,  railroad, 
and  marine  safety. 

A  FDAU  is  external  to  the  FDR  and  collects  and  digitizes  data  to  be  recorded  by  the  FDR.  The  FDR 
on  an  airplane  equipped  with  a  FDAU  can  record  additional  parameters  as  modified. 


Factual  Information 


217 


Aircraft  Accident  Report 


the  final  rule  requires  all  affected  existing  airplanes  to  “be  equipped  to  record  the 
parameters  recommended  by  the  Board”  by  August  19,  2001.^’^ 

Further,  the  FAA  stated  that  the  July  9,  1997,  final  rule  also  requires  all  airplanes 
operated  under  14  CFR  Parts  121,  125,  or  135  (10  seats  or  more)  for  which  an  original 
airworthiness  certification  is  received  after  December  31,  1996,  to  record  the  parameters 
listed  in  “Proposed  Flight  Data  Recorder  Enhancements  for  Newly  Manufactured 
Airplanes”  on  an  FDR  having  at  least  a  25-hour  recording  capacity.  The  new  FDR  rules 
call  for  parameters  1  through  57  to  be  recorded  for  airplanes  manufactured  after 
August  18,  2000,  and  parameters  1  through  88  to  be  recorded  for  airplanes  manufactured 
after  August  19,  2002.  The  FAA  considered  its  action  on  the  safety  recommendations  to 
be  completed. 

On  August  4,  1998,  the  Safety  Board  indicated  that  it  was  generally  pleased  that 
the  FAA  issued  revised  FDR  rules  because  the  changes  in  the  FDR  parameter 
requirements  offered  a  major  improvement  over  the  former  requirements.  For  example, 
the  Safety  Board  agreed  with  the  FAA’s  decision  to  include  flight  control  surface  positions 
and  flight  control  inputs  as  portions  of  the  minimum  number  of  parameters  to  be  recorded 
by  existing  airplanes.  However,  the  Board  believed  the  final  rulemaking  fell  short  of  the 
intent  of  Safety  Recommendations  A-95-26  and  -27  in  two  critical  areas: 


The  Safety  Board  is  aware  that  some  air  carriers  have  not  retrofitted  their  airplanes  with  the  required 
FDR  upgrades  during  scheduled  heavy  maintenance  checks.  For  example,  the  Board’s  investigation  of  the 
February  23,  1999,  Metrojet  upset  event  revealed  that,  although  the  incident  airplane  was  scheduled  for  a 
heavy  maintenance  check  in  March  1999,  it  was  not  scheduled  to  receive  the  required  FDR  upgrade  until  its 
next  heavy  maintenance  check  in  March  2001.  In  contrast,  the  Safety  Board  is  aware  of  one  air  carrier 
(Southwest  Airlines)  that  is  retrofitting  the  FDRs  in  its  fleet.  Southwest’s  fleet  consisted  of  248  Boeing  737s, 
100  of  which  are  already  equipped  with  FDAUs  and  enhanced  FDRs  and  thus  do  not  require  the  upgrade. 
Southwest  began  to  retrofit  its  remaining  148  Boeing  737s  in  July  1996  (about  the  same  time  that  the  FAA 
issued  the  NPRM  regarding  FDR  upgrades  and  1  year  before  the  resultant  final  rule  was  issued).  Although 
not  required  by  the  FAA’s  final  rule.  Southwest  also  elected  to  install  FDAUs  on  the  148  airplanes  that  were 
not  so  equipped  (at  a  cost  of  $70,000  per  airplane)  to  permit  future  expansion  of  FDR  parameters.  Southwest 
expected  to  have  completed  the  retrofit  all  of  its  affected  airplanes  by  December  1999. 
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•  Although  the  new  FDR  rules  would  eventually  mandate  all  of  the  Safety 
Board's  recommended  parameters  for  new  airplanes,  the  parameter 
requirements  for  existing  airplanes  were  less  than  those  referenced  in  Safety 
Recommendation  A-95-26.^*’'’  Therefore,  the  Board  disagreed  with  the  FAA's 
assertion  that  the  rule  required  airplanes  to  "be  equipped  to  record  the 
parameters  recommended  by  the  Board.” 

The  recommended  minimum  parameter  requirements  for  existing  airplanes 
were  based  on  the  Safety  Board's  investigative  experience.  The  Board  believed 
that  all  U.S. -registered  airplanes  should  record  these  parameters.  According  to 
the  Board,  the  FAA's  reasoning  for  not  including  all  the  recommended 
parameters — that  FDR  requirements  should  be  determined  by  the  capabilities 
of  the  FDR  system  fitted  to  a  specific  airplane  rather  tl]an  by  investigative 
requirements — placed  far  too  much  emphasis  on  cost.  The  Safety  Board 
recognized  that  substantial  costs  would  be  associated  with  retrofitting  all  of  the 
proposed  minimum  parameter  requirements  on  existing  airplanes  not  equipped 
with  a  FDAU  or  a  digital  data  bus.  However,  all  of  the  88  parameters 
referenced  in  Safety  Recommendation  A-95-26  are  potentially  critical  to  future 
investigations.  The  Board  maintained  that  the  FAA’s  final  rule  should  have 
included  all  the  recommended  parameters  for  existing  airplanes. 

•  The  compliance  dates  stated  in  the  final  rule  for  newly  manufactured  airplanes 
extended  far  beyond  the  recommended  compliance  dates,  and  the  Board 
believed  that  the  FAA's  reasoning  for  the  extended  compliance  dates  was 
flawed.  Although  the  final  rule  included  all  88  recommended  parameters  for 
newly  manufactured  airplanes,  the  Board  was  disappointed  that  the  recording 
of  the  88  parameters  would  not  be  accomplished  immediately.  The  new 
regulations  will  mandate  an  incremental  increase  in  FDR  capability,  from  29  to 
57  and  then  to  88  parameters.  The  Board  did  not  believe  that  this  incremental 
expansion  was  necessary  and  that  there  was  not  sufficient  justification  for 
airplanes  manufactured  between  August  18,  2000,  and  August  19,  2002,  to 
record  only  57  parameters. 

According  to  the  Safety  Board,  the  FAA  cited  the  needed  development  of 
control  force  sensors  and  availability  of  256-word-per-second  FDRs  as 
explanations  for  the  incremental  increase  of  parameters  for  newly 
manufactured  airplanes.  On  the  basis  of  its  conversations  with  airplane 
manufacturers,  the  Board  determined  that  the  necessary  technology  was 
already  available  and  that  a  5-year  development  time  for  all  88  parameters  was 
unnecessary.  In  fact,  the  Board  was  aware  that  some  operators  and 
manufacturers  had  elected  to  record,  or  at  least  to  make  provisions  to  record, 
all  88  parameters  (including  the  control  force  parameters)  on  airplanes 


^  For  example,  the  Safety  Board  recommended  that  FDRs  installed  on  affected  existing  airplanes  be 
upgraded  to  record  pitch  trim;  thrust  reverser  position;  angle-of-attack;  outside  and  total  air  temperatures; 
and  flap,  leading  edge  slat,  and  ground  spoiler  positions  in  addition  to  the  18  parameters  required  by  the 
FAA’s  final  rule.  However,  the  FAA  did  not  require  these  additional  parameters. 
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manufactured  after  August  18,  2000,  to  provide  commonality  with  airplanes 
manufactured  after  August  19,  2002.  In  addition,  FDR  manufacturers  were 
already  delivering  FDRs  that  record  at  the  higher  data  frame  rate.  Therefore, 
the  Safety  Board  urged  the  FAA  to  change  the  88-parameter  compliance  date 
for  newly  manufactured  airplanes  from  August  19,  2002,  to  August  18,  2000. 

In  addition,  the  Safety  Board  was  disappointed  that  the  FAA,  with  the  issuance  of 
its  final  rule,  considered  its  action  on  these  safety  recommendations  to  be  completed.  The 
Safety  Board  believed  that  the  FAA  did  not  make  every  effort  to  ensure  that  the  maximum 
number  of  parameters  would  be  recorded  within  an  achievable  time  period.  Because  all  of 
the  recommended  retrofit  parameters  and  the  recommended  compliance  dates  were  not 
included  in  the  FAA’s  final  rule.  Safety  Recommendations  A-95-26  and  -27  were 
classified  "Closed — Unacceptable  Action." 

1.18.11.5  October  1996  Recommendations  Issued  as  a  Result  of 
United  Flight  585,  USAir  Flight  427,  and  Eastwind  Flight  517  (Safety 
Recommendations  A-96-107  Through  -120) 

After  the  accident  involving  United  Airlines  flight  585,  the  Safety  Board  was 
informed  of  numerous  uncommanded  roll  and  yaw  events  involving  the  737  series.  Most 
of  these  incidents  did  not  result  in  any  damage  to  the  airplane  or  injuries  to  those  on  board. 
As  a  result  of  these  occurrences,  the  accident  involving  USAir  flight  427,  and  the  incident 
involving  Eastwind  flight  517,  the  Safety  Board  issued  Safety  Recommendations 
A-96-107  through  -120  on  October  18, 1996. 

Safety  Recommendation  A-96-107  asked  the  FAA  to 

Require  the  Boeing  Commercial  Airplane  Group,  working  with  other 
interested  parties,  to  develop  immediate  operational  measures  and  long¬ 
term  design  changes  for  the  737  series  airplane  to  preclude  the  potential  for 
loss  of  control  from  an  inadvertent  rudder  hardover.  Once  the  operational 
measures  and  design  changes  have  been  developed,  issue  airworthiness 
directives  to  implement  these  actions. 

On  January  16, 1997,  the  FAA  stated  that  it  intended  to  take  final  action  on  several 
proposed  ADs,  some  of  which  would  require  the  retrofit  of  four  newly  developed  or 
redesigned  components  into  the  rudder  system  of  existing  737  airplanes.  The  FAA  further 
stated  that  the  safety  issues  addressed  in  this  recommendation  would  be  resolved  during 
the  type  certification  of  the  new  main  rudder  PCU  servo  valve  and  that  it  would  propose  a 
2-year  compliance  timeframe  for  the  retrofit  of  the  servo  valve. 

On  July  15,  1997,  the  Safety  Board  noted  that  the  FAA’s  proposed  design  changes 
did  not  address  (1)  the  development  of  operational  measures  and  design  changes  to 
preclude  the  loss  of  control  from  an  inadvertent  rudder  hardover,  (2)  the  need  to  establish 
appropriate  inspection  intervals  and  a  service  life  limit  for  the  737  main  rudder  PCU 
(addressed  in  Safety  Recommendation  A-96-112),  or  (3)  a  method  to  detect  a  jammed 
PCU  servo  valve  slide  (addressed  in  Safety  Recommendation  A-96-113).  The  Safety 
Board  believed  that  operational  measures,  periodic  inspections,  and  the  detection  and 
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annunciation  of  a  jammed  slide  to  the  flight  crew  were  needed  to  ensure  flight  safety. 
Because  the  proposed  design  did  not  address  reliability  or  latent  failure  issues.  Safety 
Recommendation  A-96-107  was  classified  “Open— Unacceptable  Response.” 

On  May  13,  1998,  the  FAA  stated  that,  along  with  Boeing,  it  had  taken  several 
measures  to  address  the  intent  of  this  safety  recommendation.  These  actions  included  the 
development  and  certification  of  modifications  to  the  737  main  rudder  PCU  servo  valve  to 
prevent  the  potential  for  reverse  rudder  operation.  The  FAA  cited  its  issuance  of  the 
following  three  ADs: 

•  AD  96-26-07  was  issued  on  December  23,  1996,  and  became  effective  on 
January  17,  1997.  The  AD  required  revising  the  AFM  for  all  737  series 
airplanes  within  30  days  to  include  procedures  that  would  enable  the  flight 
crew  to  take  “appropriate  action  to  maintain  control  of  the  airplane  during  an 
uncommanded  yaw  or  roll  condition”  and  “correct  a  jammed  or  restricted 
flight  control  condition.”  The  FAA  stated  that  the  AD  had  been  prompted 
because  such  procedures  were  not  defined  adequately  in  the  existing  737  AFM. 
The  AD  established  a  “recall”  procedure  to  be  performed  by  flight  crews 
immediately,  from  memory,  in  the  event  of  an  uncommanded  yaw  or  roll  and 
required  that  the  AFM  section  concerning  procedures  for  jammed  flight 
controls  be  modified.  The  FAA  specified  that  air  carriers  could  comply  with 
the  AD  by  inserting  a  copy  of  it  in  the  AFM.  No  flight  crew  training 
requirements  were  established  by  the  FAA  for  the  procedures  that  had  been 
introduced  or  changed  by  the  AD. 

•  AD  97-14-03  was  issued  on  June  23,  1997,  and  became  effective  on  August  1, 
1997.  The  AD  mandated  design  changes  to  all  737  airplanes  by  August  1, 
2000.  The  AD  required  the  installation  of  (1)  a  hydraulic  pressure  reducer  to 
limit  the  amount  of  rudder  available  to  the  flight  crew  during  certain  portions 
of  flight  and  (2)  a  redesigned  yaw  damper  system  to  improve  reliability  and 
fault  monitoring  capability. 

•  AD  97-14-04,  which  superceded  ADs-94-01-07  and  96-23-51,  was  also  issued 
on  June  23, 1997,  and  became  effective  on  August  4,  1997.  The  AD  mandated 
design  changes  to  the  main  rudder  PCU  and  servo  valve  on  all  737  airplanes, 
within  2  years,  to  “prevent  uncommanded  movements  of  the  rudder,  and 
consequent  reduced  controllability  of  the  airplane.”  In  addition,  this  AD 
mandated  a  periodic  inspection  to  test  the  main  rudder  PCU  for  internal 
leakage  and  ensure  that  it  is  producing  an  acceptable  hinge  moment.  According 
to  the  FAA,  the  internal  leakage  test  will  detect  certain  servo  valve  slide  jams 
and  provide  greater  safety  margins  than  a  hard-time  replacement  of  the  main 
rudder  PCU  because  the  test  will  ensure  that  the  PCU  is  functioning  within 
acceptable  limits  at  more  frequent  intervals  than  a  hard-time  interval.  The  FAA 
also  said  that  any  design  change  to  monitor  the  servo  valve  slides  would 
increase  the  complexity  of  the  servo  valve  and  most  likely  increase  the 
probability  of  jamming  of  a  slide. 
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The  FAA  also  stated  in  its  May  13,  1998,  letter  that  the  Safety  Board  had 
expressed  concern  that,  although  the  redesigned  servo  valve  eliminated  all  known  rudder 
reversal  modes,  unknown  failures  might  still  exist  in  the  system.  The  FAA  concluded  that 
no  evidence,  either  from  in-service  experience  or  testing,  indicated  that  a  rudder  reversal 
event  had  actually  occurred.  The  FAA  noted  that  the  main  rudder  PCU  had  been  tested  to 
evaluate  chip  shear  capacity,  fluid  contamination,  thermal  jam  conditions,  input  linkage 
jams,  and  linkage  compliance.  According  to  the  FAA,  all  of  these  tests  failed  to  create  a 
sustained  servo  valve  jam  or  any  other  reasonable  failure  that  could  cause  erroneous 
rudder  movement. 

In  addition,  the  FAA’s  letter  included  the  Safety  Board’s  position  that  the  detection 
and  indication  of  a  slide  jam  were  necessary  because,  if  a  single  slide  jam  was  not 
recognized  by  the  flight  crew  or  mechanics,  a  second  slide  jam  would  cause  an  accident  in 
some  airplane  configurations  and  flight  conditions.  The  Board  considered  this  event  to  be 
a  catastrophic  failure  condition.  However,  the  FAA  stated  that  its  regulations  and  policy 
define  a  catastrophic  failure  condition  as  one  that  will  always  result  in  an  accident. 
According  to  the  FAA,  a  dual  slide  jam  in  the  rudder  PCU  will  not  always  result  in  an 
accident  and  thus  should  not  be  considered  a  catastrophic  condition.  The  FAA  also  stated 
that  an  airplane  with  a  dual  slide  jam  in  the  rudder  PCU  would  be  fully  controllable  in  that 
configuration  throughout  much  of  its  flight  envelope.  Furthermore,  the  FAA  believed  that, 
on  the  basis  of  737  service  history  and  number  of  hours  of  operation,  a  dual  slide  servo 
valve  jam  would  be  extremely  improbable. 

On  February  2,  1999,  the  Safety  Board  stated  that  it  would  further  analyze  and 
discuss  Safety  Recommendation  A-96-107  in  the  USAir  flight  427  accident  report.  The 
Board  indicated  that,  pending  the  analysis  and  discussion,  Safety  Recommendation 
A-96-107  remained  classified  “Open — Unacceptable  Response.”  The  Safety  Board’s 
evaluation  of  Safety  Recommendation  A-96-107  and  the  recommendation’s  current 
classification  are  discussed  in  section  2.6. 

Safety  Recommendation  A-96-108  asked  the  FAA  to 

Revise  14  CFR  Section  25.671  to  account  for  the  failure  or  jamming  of  any 
flight  control  surface  at  its  design-limited  deflection.  Following  this 
revision,  reevaluate  all  transport-category  aircraft  and  ensure  compliance 
with  the  revised  criteria. 

On  January  16,  1997,  the  FAA  stated  that  its  aircraft  certification  offices  were 
reviewing  data  from  airplane  manufacturers  to  determine  which  airplanes  certified  under 
14  CFR  Part  25  utilize  PCU  servo  valves  that  could  encounter  valve  jamming  problems 
resulting  from  unexpected  improper  positioning  of  the  servo  slides.  The  FAA  stated  that  it 
would  take  appropriate  action  based  on  the  results  of  the  review.  On  July  15,  1997,  the 
Safety  Board  responded  that,  because  the  FAA  had  not  specified  its  planned  actions. 
Safety  Recommendation  A-96-108  was  classified  “Open — ^Await  Response.” 

On  May  13,  1998,  the  FAA  indicated  that  it  decided  not  to  revise  14  CFR  Section 
25.671.  The  FAA  did  not  concur  with  the  Safety  Board's  position  that  it  is  necessary  to 
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account  for  a  jam  in  any  flight  control  surface  at  its  design-limited  deflection.  According 
to  the  FAA,  a  control  surface  Jam  at  its  design-limited  deflection  during  flight  would 
require  an  active  system  failure  to  cause  the  control  surface  to  move  to  the  extreme 
position  and  remain  there.  The  FAA  indicated  that  the  last  sentence  of  14  CFR  Section 
25.671(c)(3)  required  that  such  a  jam  be  accounted  for  unless  such  a  jam  can  be  shown  to 
be  extremely  improbable.  The  FAA  stated  that  an  applicant  can  show  compliance  with  the 
regulation  by  demonstrating,  based  on  a  probability  analysis,  that  the  runaway  and  jam 
condition  is  an  extremely  improbable  event  or  that  the  condition  can  be  alleviated. 
Because  a  jam  condition  is  more  likely  to  occur  in  a  control  position  normally 
encountered,  the  FAA’s  policy  requires  the  applicant  to  demonstrate  controllability  for  this 
condition. 

On  February  2,  1999,  the  Safety  Board  stated  that  it  would  further  analyze  and 
discuss  Safety  Recommendation  A-96-108  in  the  USAir  flight  427  accident  report.  The 
Board  indicated  that,  pending  the  analysis  and  discussion.  Safety  Recommendation 
A-96-108  remained  classified  “Open — Await  Response.”  The  Safety  Board’s  evaluation 
of  Safety  Recommendation  A-96-108  and  the  recommendation’s  current  classification  are 
discussed  in  section  2.6. 

Safety  Recommendation  A-96-109  asked  the  FAA  to 

Require  the  Boeing  Commercial  Airplane  Group  to  develop  and  install  on 
all  new-production  737  airplanes  a  cockpit  indicator  system  that  indicates 
rudder  surface  position  and  movement.  For  existing  737  airplanes,  when 
implementing  the  installation  of  an  enhanced-parameter  flight  data 
recorder,  require  the  installation  of  a  cockpit  indicator  system  that  indicates 
rudder  surface  position  and  movement. 

On  January  16,  1997,  the  FAA  stated  that  an  additional  indicator  in  the  cockpit 
would  add  no  practical  information  to  the  pilot  because  all  rudder  movements  on  the  737, 
except  those  caused  by  the  yaw  damper,  are  directly  apparent  to  the  flight  crew  through 
the  movement  of  the  rudder  pedals.  The  FAA  further  stated  that  a  rudder  position  indicator 
will  have  very  little  value  during  the  immediacy  of  a  roll/yaw  departure  from  controlled 
flight  because  such  an  event  would  require  prompt  and  aggressive  pilot  response 
depending  on  the  attitude,  rate,  and  acceleration  experienced. 

On  July  15,  1997,  the  Safety  Board  responded  that  it  agreed  with  the  FAA’s 
assertion  that  a  rudder  position  indicator  would  be  of  little  value  in  the  initial  moments  of 
an  upset  during  which  immediate  pilot  reaction  may  be  needed  to  prevent  a  loss  of  control. 
However,  the  Safety  Board  disagreed  with  the  FAA’s  position  that  a  rudder  position 
indicator  would  provide  no  practical  information  to  the  pilot.  The  Safety  Board's 
investigation  of  numerous  yaw/roll  upset  events  found  that  pilots,  when  trying  to 
troubleshoot  the  problem,  are  often  uncertain  about  the  position  of  the  rudder  in  the 
moments  after  regaining  control.  The  Safety  Board  noted  that  recent  testing  had  indicated 
the  possibility  for  reverse  rudder  operation  and  that  the  installation  of  a  rudder  position 
indicator  would  provide  a  means  for  the  pilot  to  understand  that  a  rudder  reversal  had 
occurred.  The  Safety  Board  also  noted  that  essentially  all  new-production  737s  and  other 
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transport-category  airplanes  are  equipped  with  rudder  position  indicators.  As  a  result, 
Safety  Recommendation  A-96-109  was  classified  “Open — ^Unacceptable  Response.” 

On  May  13,  1998,  the  FAA  reiterated  its  position  that  it  is  not  necessary  to  require 
the  installation  of  a  rudder  indicator  system  in  737  airplanes.  The  FAA  repeated  that  any 
rudder  movement  outside  the  small  movement  of  the  yaw  damper  system  will  back-drive 
the  rudder  pedals  and  be  noted  by  the  pilots  if  their  feet  are  on  the  pedals.  Further,  the  FAA 
believed  that  ADs  96-26-07,  97-14-03,  and  97-14-04  preclude  a  rudder  jam/reversal 
scenario  and  support  the  conclusion  that  a  rudder  surface  position  indicator  should  not  be 
mandated. 

On  February  2,  1999,  the  Safety  Board  stated  that  it  would  further  analyze  and 
discuss  Safety  Recommendation  A-96-109  in  the  USAir  flight  427  accident  report.  The 
Board  indicated  that,  pending  the  analysis  and  discussion.  Safety  Recommendation 
A-96-109  remained  classified  “Open — Unacceptable  Response.”  The  Safety  Board’s 
evaluation  of  Safety  Recommendation  A-96-109  and  the  recommendation’s  current 
classification  are  discussed  in  section  2.6. 

Safety  Recommendation  A-96-110  asked  the  FAA  to 

Conduct  a  detailed  engineering  review  of  the  737  yaw  damper  system,  and 
require  the  Boeing  Commercial  Airplane  Group  to  redesign  the  yaw 
damper  system,  as  necessary,  to  eliminate  the  potential  for  sustained 
uncommanded  yaw  damper  control  events.  After  the  737  yaw  damper 
system  is  redesigned,  issue  an  airworthiness  directive  to  require  the 
installation  of  the  improved  yaw  damper  system  on  all  737  series  airplanes. 

On  June  23,  1997,  the  FAA  issued  AD  97-14-03.  In  its  May  13,  1998,  letter,  the 
FAA  explained  that  Boeing  was  developing  design  changes  to  the  rudder  limiter  and  yaw 
damper  system  to  comply  with  the  requirements  of  the  AD.  The  FAA  indicated  that  the 
Manager  of  the  Seattle  Aircraft  Certification  Office  was  expected  to  approve  the  design 
changes  by  July  31,  1998.  On  February  2,  1999,  the  Safety  Board  stated  that,  pending  the 
FAA’s  certification  of  the  proposed  new  yaw  damper  system.  Safety  Recommendation 
96-110  was  classified  “Open — Acceptable  Response.” 

Safety  Recommendation  A-96-111  asked  the  FAA  to 

Require  the  Boeing  Commercial  Airplane  Group  and  the  operating  airlines 
to  eliminate  the  procedure  for  removal  and  replacement  of  the  main  rudder 
power  control  unit  rudder  position  transducer  from  their  respective  737 
maintenance  manuals  unless  the  manual  provides  for.  testing  to  verify  that 
the  replacement  transducer  performs  its  intended  function.. 

According  to  the  FAA’s  August  7,  1997,  letter,  Boeing  issued  a  revision  to  its  737 
MM  on  November  27,  1996,  to  eliminate  the  removal  and  installation  sections  for  the 
main  rudder  PCU  rudder  position  transducer.  This  revision  was  applicable  to  737-100 
through  -500  series  airplanes.  On  November  4, 1997,  the  Safety  Board  stated  that,  because 
this  revision  met  the  intent  of  Safety  Recommendation  A-96-111,  it  was  classified 
“Closed — Acceptable  Action.” 
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Safety  Recommendation  A-96-112  asked  the  FA  A  to 

Require  the  Boeing  Commercial  Airplane  Group  to  establish  appropriate 
inspection  intervals  and  a  service  life  limit  for  the  737  main  rudder  power 
control  unit. 

On  January  16, 1997,  the  FAA  stated  that  it  intended  to  take  final  action  on  several 
proposed  ADs,  some  of  which  would  require  the  retrofit  of  four  newly  developed  or 
redesigned  coniponents  into  the  rudder  system  of  existing  737  airplanes.  The  FAA  stated 
that  the  safety  issues  addressed  in  this  recommendation  would  be  resolved  during  the  type 
certification  of  the  new  main  rudder  PCU  servo  valve  and  that  it  would  propose  a  2-year 
compliance  timeframe  for  the  retrofit  of  the  servo  valve. 

On  July  15,  1997,  the  Safety  Board  noted  that  the  FAA’s  proposed  design  changes 
did  not  address  (1)  the  development  of  operational  measures  and  design  changes  to 
preclude  the  loss  of  control  from  an  inadvertent  rudder  hardover  (addressed  in  Safety 
Recommendation  A-96-107),  (2)  the  need  to  establish  appropriate  inspection  intervals  and 
a  service  life  limit  for  the  737  main  rudder  PCU,  or  (3)  a  method  to  detect  a  jammed  PCU 
servo  valve  slide  (addressed  in  Safety  Recommendation  A-96-113).  The  Safety  Board 
believed  that  operational  measures,  periodic  inspections,  and  the  detection  and 
annunciation  of  a  jammed  slide  to  the  flight  crew  were  needed  to  ensure  flight  safety. 
Because  the  proposed  design  did  not  address  reliability  or  latent  failure  issues.  Safety 
Recommendation  A-96-112  was  classified  “Open — ^Unacceptable  Response.” 

On  May  13,  1998,  the  FAA  stated  that,  along  with  Boeing,  it  had  taken  several 
measures  to  address  the  intent  of  this  safety  recommendation.  These  actions  included  the 
development  and  certification  of  modifications  to  the  737  main  rudder  PCU  servo  valve  to 
prevent  the  potential  for  reverse  rudder  operation.  Also,  the  FAA  issued  ADs  96-26-07, 
97-14-03,  and  97-14-04.  In  addition,  the  FAA’s  letter  noted  the  Safety  Board’s  concerns 
that  unknown  failures  might  still  exist  in  the  redesigned  servo  valve  and  that,  if  a  single 
slide  jam  was  not  recognized  by  the  flight  crew  or  mechanics,  a  second  slide  jam  would 
cause  an  accident  in  some  airplane  configurations  and  flight  conditions.  The  FAA’s 
response  included  its  position  on  what  constitutes  a  catastrophic  failure  condition  and 
whether  a  dual  slide  jam  would  be  considered  a  catastrophic  condition. 

On  February  2,  1999,  the  Safety  Board  stated  that  it  would  further  analyze  and 
discuss  Safety  Recommendation  A-96-112  in  the  USAir  flight  427  accident  report.  The 
Board  indicated  that,  pending  the  analysis  and  discussion.  Safety  Recommendation 
A-96-112  remained  classified  “Open — Unacceptable  Response.”  The  Safety  Board’s 
evaluation  of  Safety  Recommendation  A-96-112  and  the  reconunendation’s  current 
classification  are  discussed  in  section  2.6. 

Safety  Recommendation  A-96-113  asked  the  FAA  to 

Require  the  Boeing  Commercial  Airplane  Group  to  devise  a  method  to 
detect  a  primary  or  a  secondary  jammed  slide  in  the  737  main  rudder  power 
control  unit  servo  valve  and  ensure  appropriate  communication  of  the 
information  to  mechanics  and  pilots. 
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On  January  16, 1997,  the  FAA  stated  that  it  intended  to  take  final  action  on  several 
proposed  ADs,  some  of  which  would  require  the  retrofit  of  four  newly  developed  or 
redesigned  components  into  the  rudder  system  of  existing  737  airplanes.  The  FAA  stated 
that  the  safety  issues  addressed  in  this  recommendation  would  be  resolved  during  the  type 
certification  of  the  new  main  rudder  PCU  servo  valve  and  that  it  would  propose  a  2-year 
compliance  timeframe  for  the  retrofit  of  the  servo  valve. 

On  July  15,  1997,  the  Safety  Board  noted  that  the  FAA’s  proposed  design  changes 
did  not  address  (1)  the  development  of  operational  measures  and  design  changes  to 
preclude  the  loss  of  control  from  an  inadvertent  rudder  hardover  (addressed  in  Safety 
Recommendation  A-96-107),  (2)  the  need  to  establish  appropriate  inspection  intervals  and 
a  service  life  limit  for  the  737  main  rudder  PCU  (addressed  in  Safety  Recommendation 
A-96-112),  or  (3)  a  method  to  detect  a  jammed  PCU  servo  valve  slide.  The  Safety  Board 
believed  that  operational  measures,  periodic  inspections,  and  the  detection  and 
annunciation  of  a  jammed  slide  to  the  flight  crew  were  needed  to  ensure  flight  safety. 
Because  the  proposed  design  did  not  address  reliability  or  latent  failure  issues,  Safety 
Recommendation  A-96-113  was  classified  “Open — Unacceptable  Response.” 

On  May  13,  1998,  the  FAA  stated  that,  along  with  Boeing,  it  had  taken  several 
measures  to  address  the  intent  of  this  safety  recommendation.  These  actions  included  the 
development  and  certification  of  modifications  to  the  737  main  rudder  PCU  servo  valve  to 
prevent  the  potential  for  reverse  rudder  operation.  Also,  the  FAA  issued  ADs  96-26-07, 
97-14-03,  and  97-14-04.  In  addition,  the  FAA’s  letter  noted  the  Safety  Board’s  concerns 
that  unknown  failures  might  still  exist  in  the  redesigned  servo  valve  and  that,  if  a  single 
slide  jam  was  not  recognized  by  the  flight  crew  or  mechanics,  a  second  slide  jam  would 
cause  an  accident  in  some  airplane  configurations  and  flight  conditions.  The  FAA’s 
response  included  its  position  on  what  constitutes  a  catastrophic  failure  condition  and 
whether  a  dual  slide  jam  would  be  considered  a  catastrophic  condition.  (For  further 
information  on  the  FAA’s  response,  see  A-96-107.) 

On  February  2,  1999,  the  Safety  Board  stated  that  it  would  further  analyze  and 
discuss  Safety  Recommendation  A-96-113  in  the  USAir  flight  427  accident  report.  The 
Board  indicated  that,  pending  the  analysis  and  discussion,  Safety  Recommendation 
A-96-113  remained  classified  “Open — Unacceptable  Response.”  The  Safety  Board’s 
evaluation  of  Safety  Recommendation  A-96-113  and  the  recommendation’s  current 
classification  are  discussed  in  section  2.6. 

Safety  Recommendation  A-96-114  asked  the  FAA  to 

Evaluate  the  adequacy  of  the  chip  shearing  capacity  for  all  sliding  spool 
control  valves  used  in  transport-category  aircraft  flight  control  systems, 
and  take  appropriate  action  to  correct  any  problems  identified  to  preclude 
the  potential  for  actuator  jamming,  binding,  or  failure. 

On  June  29,  1998,  the  FAA  stated  that  its  aircraft  certification  offices  have 
evaluated  the  adequacy  of  the  chip  shearing  capacity  of  sliding  spool  control  valves  for 
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certain  airplanes.  The  criteria  used  in  this  evaluation  were  recommended  by  the  SAE  A-6 
Committee  and  incorporated  information  from  an  August  12,  1997,  letter  by  Boeing. 

The  FAA  concluded  that  all  sliding  spool  control  valves  used  in  the  following 
transport-category  airplanes’  flight  control  systems  met  the  evaluation  criteria: 

•  Boeing  707  (except  the  rudder  system),  727,  737,  747,  757,  767,  and  777; 

•  McDonnell  Douglas  DC-9,  DC- 10,  MD- 1 1 ,  MD-80,  and  MD-90; 

•  Lockheed  L-1011  and  L-382 

•  Gulfstream  V; 

•  Saab  340  and  2000; 

•  Domier  DO-328; 

•  Fokker  F.28  (all  models); 

•  Embraer  EMB  - 1 20  and  EMB  - 1 45 ;  and 

•  Cessna,  Learjet,  Raytheon,  and  Sabreliner  (applicable  models). 

The  FAA  planned  no  further  action  for  these  airplanes.  However,  the  FAA  was 
waiting  for  data  from  European  and  Canadian  manufacturers,  additional  data  for  the  707 
rudder  system,  and  data  for  the  Douglas  DC-8  airplanes.  These  data  were  expected  to  be 
received  by  July  1998. 

On  February  2,  1999,  the  Safety  Board  indicated  that  it  would  like  to  review  the 
FAA’s  evaluation  criteria  for  determining  the  adequacy  of  the  chip  shearing  capacity  of 
sliding  spool  control  valves.  Pending  the  Board’s  review  of  the  criteria  and  the  FAA’s 
completion  of  the  evaluation  project.  Safety  Recommendation  A-96-114  was  classified 
“Open — Acceptable  Response.” 

Safety  Recommendation  A-96-115  asked  the  FAA  to 

Require  the  modification  of  the  input  rod  bearing  on  the  737  series  standby 

rudder  actuator,  by  August  1,  1997,  to  prevent  galling  and  possible 

discrepant  operation  of  the  rudder  system. 

The  FAA  issued  AD  97-26-01,  which  became  effective  January  20,  1998,  to 
require  repetitive  inspections  to  detect  galling  on  the  input  shaft  and  bearing  of  the 
standby  rudder  PCU  and  replacement  of  the  standby  rudder  actuator  with  a  serviceable 
actuator,  if  necessary.  The  AD  also  required  the  installation  of  a  newly  designed  standby 
PCU  input  shaft  bearing  within  3  years  of  the  effective  date  of  the  AD.  On  February  2, 
1999,  the  Safety  Board  stated  that,  because  the  FAA’s  action  complied  with  the  intent  of 
Safety  Recommendation  A-96-115,  it  was  classified  “Closed— Acceptable  Action.” 
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Safety  Recommendation  A-96-116  asked  the  FAA  to 

Define  and  implement  standards  for  in-service  hydraulic  fluid  cleanliness 
requirements  and  sampling  intervals  for  all  transport-category  aircraft. 

On  June  29,  1998,  the  FAA  stated  that  it  had  reviewed  a  study  by  the  SAE  A-6 
Committee  Hydraulic  Fluid  Contamination  Task  Force.  On  the  basis  of  the  study’s 
findings,  the  FAA  identified  NAS  1638  as  an  industry  standard  that  defines  fluid 
cleanliness  levels;  defined  NAS  1638  Class  9  as  the  in-service  limit;  and  verified  that 
manufacturers  already  included  or  are  in  the  process  of  including  this  limit  in  their 
maintenance  manuals,  along  with  a  sampling  interval.  The  FAA  added  that  it  was 
participating  in  the  development  of  an  Aerospace  Recommended  Practice  document  for 
sampling  and  testing  techniques.  On  February  2,  1999,  the  Safety  Board  stated  that, 
because  the  FAA’s  actions  met  the  intent  of  Safety  Recommendation  A-96-116,  it  was 
classified  “Closed — ^Acceptable  Action.” 

Safety  Recommendation  A-96-117  asked  the  FAA  to 

Conduct  a  detailed  design  review  of  all  dual-concentric  servo  valves  that 
control  essential  flight  control  system  actuators  on  transport-category 
airplanes  certificated  by  the  Federal  Aviation  Administration  to  determine 
if  the  design  is  susceptible  to  inducing  flight  control  malfunctions  and/or 
reversals  as  a  result  of  unexpected  improper  positioning  of  the  servo  slides. 

If  the  design  is  determined  to  be  susceptible,  mandate  appropriate  design 
changes. 

In  a  July  15,  1997,  letter  to  the  FAA,  the  Safety  Board  stated  that  recent  tests  had 
found  that  the  737  main  rudder  PCU  could  possibly  cause  reverse  rudder  operation  if  the 
servo  valve  secondary  slide  were  to  jam.  This  finding  had  not  been  indicated  by  numerous 
prior  tests  and  research  and  was  unknown  at  the  time  that  the  Board  issued  this  safety 
recommendation.  Thus,  the  Board  believed  that  extra  efforts  needed  to  be  taken  to 
determine  if  any  other  dual-concentric  servo  valves  are  susceptible  to  flight  control 
malfunctions  as  a  result  of  unexpected  improper  positioning  of  the  servo  slides. 

On  May  13, 1998,  the  FAA  stated  that  its  detailed  design  review  of  dual-concentric 
servo  valves  would  address  this  recommendation.  Also  on  May  13,  1998,  and  again  on 
June  29,  1998,  the  FAA  stated  that  its  aircraft  certification  offices  reviewed  the  data  from 
airplane  manufacturers  under  their  geographic  purview  and  determined  that  12 
dual-concentric  servo  valves,  used  on  various  transport-category  airplane  flight  control 
systems,  needed  a  detailed  design  review.  Ten  of  these  valves  are  used  on  Boeing  707, 
727, 737,  and  747  series  airplanes;  one  is  used  on  McDonnell  Douglas  DC- 10  and  MD-11 
series  airplanes;  and  one  is  used  on  the  Lockheed  L-1011  series  airplane.  The  FAA  further 
stated  that  the  valve  jam  conditions,  including  those  involving  the  secondary  slide,  and 
evaluation  criteria  had  been  identified. 

Also  on  June  29, 1998,  the  FAA  stated  that  it  had  reviewed  additional  study  results 
submitted  by  Boeing,  its  Douglas  Products  Division,  and  Lockheed  Martin;  however, 
Boeing  was  still  reviewing  the  707  rudder  PCU.  The  FAA  indicated  that  it  would  review 
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the  results  of  the  707  rudder  PCU  evaluation  as  soon  as  it  was  completed.  In  addition,  the 
FAA  stated  that  it  issued  ADs  for  two  servo  valves  and  found  nine  servo  valves  to  be 
acceptable. 

On  February  2,  1999,  the  Safety  Board  noted  that  airplanes  produced  by  Airbus 
were  not  mentioned  as  part  of  the  FAA’s  evaluation.  Pending  the  Board’s  review  of  the 
results  of  the  FAA’s  detailed  design  review,  including  a  review  of  Airbus  flight  control 
systems.  Safety  Recommendation  A-96-117  was  classified  “Open — Acceptable 
Response.” 

Safety  Recommendation  A-96-118  asked  the  FAA  to 

Require  the  Boeing  Commercial  Airplane  Group,  working  with  other 
interested  parties,  to  develop  procedures  that  require  737  flight  crews  to 
disengage  the  yaw  damper  in  the  event  of  an  uncommanded  yaw  upset  as  a 
memorized  or  learned  action.  Once  the  procedures  are  developed,  require 
operators  to  implement  these  procedures. 

On  January  16,  1997,  the  FAA  stated  that  Boeing  had  taken  appropriate  action  to 
address  this  issue.  Specifically,  Boeing  revised  its  737  Operations  Manual  and  published 
an  Operations  Manual  Bulletin  to  amend  the  “Uncommanded  Yaw”  procedure  to 
“Uncommanded  Yaw  and  Roll  Procedure.”  According  to  the  FAA,  the  revised  Operations 
Manual  Bulletin  addressed  the  three  failure  modes  of  the  737  yaw  damper  system  and 
provided  specific  guidance  to  the  flight  crew  on  how  to  address  each  of  the  failure  modes. 
The  FAA  stated  that  it  planned  no  further  action  on  this  issue. 

On  July  15,  1997,  the  Safety  Board  responded  that  the  revision  to  Boeing’s 
Operations  Manual  does  not  advise  flight  crews  to  disengage  the  yaw  damper  as  a 
memorized  or  learned  item  in  the  event  of  an  uncommanded  roll.  Additionally,  the  Safety 
Board  was  aware  that  not  all  operators  had  adopted  a  procedure  to  disengage  the  yaw 
damper  as  a  memorized  or  learned  item.  The  Board  requested  that  the  FAA  reconsider  its 
position  not  to  take  further  action  on  this  issue.  As  a  result.  Safety  Recommendation 
A-96-118  was  classified  “Open — Unacceptable  Response.” 

On  May  13,  1998,  the  FAA  indicated  that  Boeing  revised  its  737  AFM  to  include 
procedures  that  enable  the  flight  crew  to  take  appropriate  action  to  maintain  control  of  the 
airplane  during  an  uncommanded  yaw  or  roll  condition  and  correct  a  jammed  or  restricted 
flight  control  condition. 

On  February  2,  1999,  the  Safety  Board  stated  that  it  would  further  analyze  and 
discuss  Safety  Recommendation  A-96-118  in  the  USAir  flight  427  accident  report.  The 
Board  indicated  that,  pending  the  analysis  and  discussion.  Safety  Recommendation 
A-96-118  remained  classified  “Open — Unacceptable  Response.”  The  Safety  Board’s 
evaluation  of  Safety  Recommendation  A-96-118  and  the  recommendation’s  current 
classification  are  discussed  in  section  2.7.2. 
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Safety  Recommendation  A-96-119  asked  the  FAA  to 

Require  the  Boeing  Commercial  Airplane  Group  to  develop  operational 
procedures  for  737  flight  crews  that  effectively  deal  with  a  sudden 
uncommanded  movement  of  the  rudder  to  the  limit  of  its  travel  for  any 
given  flight  condition  in  the  airplane's  operational  envelope.  Once  the 
operational  procedures  have  been  developed,  require  737  operators  to 
provide  this  training  to  their  pilots. 

On  January  16, 1997,  the  FAA  stated  that  it  directed  the  Seattle  Aircraft  Evaluation 
Group,  along  with  Boeing  and  the  Seattle  Aircraft  Certification  Office,  to  develop  a  pilot 
operating  procedure  for  recovery  techniques  of  sudden  uncommanded  movement  of  the 
rudder  to  its  maximum  limit.  This  new  procedure  would  be  incorporated  into  the 
737  AFM.  The  FAA  also  stated  that,  once  the  procedure  is  developed  and  the  AFM  is 
revised,  it  would  issue  a  FSIB  directing  POIs,  whose  carriers  operate  737  airplanes,  to 
inform  pilots  of  the  new  procedure  and  ensure  that  they  are  trained  during  their  next 
scheduled  recurrent  training. 

On  July  15,  1997,  the  Safety  Board  responded  that  the  potential  for  a  rudder 
movement  opposite  from  that  commanded  by  pilot  input  on  the  rudder  pedals  was  not 
included  as  part  of  this  recommendation.  Because  Safety  Recommendation  A-97-18, 
which  had  been  issued  on  February  20,  1997,  superceded  the  earlier  recommendation  by 
addressing  this  rudder  movement  situation.  Safety  Recommendation  A-96-119  was 
classified  “Closed — Acceptable  Action.” 

Safety  Recommendation  A-96-120  asked  the  FAA  to 

Require  14  CFR  Part  121  and  135  operators  to  provide  training  to  flight 
crews  in  the  recognition  of  and  recovery  from  unusual  attitudes  and  upset 
maneuvers,  including  upsets  that  occur  while  the  aircraft  is  being 
controlled  by  automatic  flight  control  systems,  and  unusual  attitudes  that 
result  from  flight  control  malfunctions  and  uncommanded  flight  control 
surface  movements. 

This  recommendation  expanded  on  the  intent  of  Safety  Recommendation  A-96-66, 
which  was  issued  on  August  15,  1996,  as  a  result  of  the  Safety  Board’s  investigation  into 
the  accident  involving  American  Eagle  flight  4184,  an  ATR-72,  near  Roselawn,  Indiana, 
on  October  31, 1994.^°'  The  airplane,  which  was  operated  by  Simmons  Airlines,  had  been 
in  a  holding  pattern  and  was  descending  to  a  newly  assigned  altitude  of  8,000  feet  when 
the  initial  uncommanded  roll  excursion  occurred.  The  airplane  entered  a  rapid  descent  and 
crashed.  All  68  people  on  board  were  killed,  and  the  airplane  was  destroyed  by  impact 
forces.  Safety  Recommendation  A-96-66  asked  the  FAA  to  amend  the  FARs  to  require 
operators  to  provide  standardized  training  that  adequately  addresses  the  recovery  from 
unusual  events,  including  extreme  flight  attitudes  in  large  transport-category  airplanes. 


See  National  Transportation  Safety  Board.  1996.  In-Flight  Icing  Encounter  and  Loss  of  Control, 
Simmons  Airlines,  d.b.a.  American  Eagle  Flight  4184,  Avions  de  Transport  Regional  (ATR)  Model  72-212, 
N40IAM,  Roselawn,  Indiana,  October  31,  1994.  Aircraft  Accident  Report  NTSB/AAR-96/01.  Washington, 
DC. 
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In  issuing  Safety  Recommendation  A-96-120,  the  Safety  Board  recognized  that 
pilots  receive  unusual  attitude  training  when  obtaining  their  private  pilot  and  commercial 
pilot  certificates  as  well  as  their  instrument  ratings.  However,  the  Safety  Board  believed 
that  the  ability  of  pilots  to  recognize  and  recover  from  an  unusual  attitude  could  be 
severely  diminished  without  additional  or  recurrent  unusual  attitude  training.  Therefore, 
Safety  Recommendation  A-96-66  was  classified  “Closed — No  Longer  Applicable/ 
Superceded.” 

On  January  16,  1997,  the  FAA  responded  to  Safety  Recommendation  A-96-120. 
The  FAA  stated  that  it  was  considering  an  NPRM  proposing  to  require  that  air  carriers 
conduct  training  that  will  emphasize  recognition,  prevention,  and  recovery  from  aircraft 
attitudes  that  are  not  normally  associated  with  air  carrier  flight  operations. 

On  July  15, 1997,  the  Safety  Board  responded  that  it  was  not  aware  of  any  training 
in  which  the  unusual  attitude  was  the  result  of  a  control  system  failure  or  in  which  some 
flight  controls  would  not  be  available  for,  or  would  be  counterproductive  to,  the  recovery. 
The  Safety  Board  encouraged  the  FAA  to  address  the  full  intent  of  this  recommendation. 
Pending  the  Board’s  review  of  the  FAA’s  final  action.  Safety  Recommendation  A-96-120 
was  classified  “Open — ^Acceptable  Response.”  The  Safety  Board’s  review  and  evaluation 
of  the  FAA’s  actions  in  response  to  Safety  Recommendation  A-96-120  and  the 
recommendation’s  current  classification  are  discussed  in  section  2.7.1. 

1.18.11.6  February  1997  Recommendations  Issued  as  a  Result  of 
United  Flight  585,  USAir  Flight  427,  and  Eastwind  Flight  517  (Safety 
Recommendations  A-97-1 6  Through  -18) 

As  a  result  of  the  numerous  occurrences  of  uncommanded  roll  and  yaw  events 
involving  737  series  airplanes,  the  accidents  involving  United  flight  585  and  USAir  flight 
427,  and  the  incident  involving  Eastwind  flight  517,  the  Safety  Board  issued  Safety 
Recommendations  A-97-16  through  -18  on  February  20,  1997. 

Safety  Recommendation  A-97-16  asked  the  FAA  to 

Require  the  expeditious  installation  of  a  redesigned  main  rudder  power 
control  unit  on  Boeing  737  series  airplanes  to  preclude  reverse  operation  of 
the  rudder  and  ensure  that  the  airplanes  comply  with  the  intent  of  the 
certification  requirements. 

On  June  23,  1997,  the  FAA  issued  AD  97-14-04,  which  requires,  by  August  1999, 
the  installation  of  a  newly  redesigned  main  rudder  PCU  on  all  737  series  airplanes.  Boeing 
indicated  that  the  new  PCU  would  preclude  the  rudder  reversal  scenarios  that  have  been 
previously  identified  or  hypothesized.  On  February  2,  1999,  the  Safety  Board  indicated 
that,  because  the  FAA’s  action  complied  with  the  intent  of  Safety  Recommendation 
A-97-16,  it  was  classified  “Closed — Acceptable  Action.” 
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Safety  Recommendation  A-97-17  asked  the  FAA  to 

Advise  737  pilots  of  the  potential  hazard  for  a  jammed  secondary  servo 
control  valve  slide  in  the  main  rudder  power  control  unit  to  cause  a  reverse 
rudder  response  when  a  full  or  high-rate  input  is  applied  to  the  rudder 
pedals. 

On  April  18,  1997,  the  FAA  stated  that  AD  96-26-07,  which  was  issued  on 
December  23, 1996,  and  became  effective  on  January  17, 1997,  required  Boeing  to  revise 
its  AFM  to  include  procedures  that  would  enable  a  flight  crew  to  take  appropriate  action  to 
maintain  control  of  the  airplane  during  an  uncommanded  yaw  or  roll  condition  and  correct 
a  jammed  or  restricted  flight  control  condition.  The  FAA  also  stated  that  it  was  developing 
an  FSIB  to  meet  the  intent  of  this  recommendation. 

On  January  29,  1998,  the  FAA  issued  FSIB  98-03,  “Recognition  of  and  Recovery 
From  Unusual  Attitudes  and  Upsets  Caused  by  Reverse  Rudder  Response  Involving 
Boeing  737s.”  The  FSIB  directs,  among  other  things,  that  POIs  advise  their  air  carriers  to 
inform  pilots  of  (1)  the  potential  for  a  jammed  servo  valve  secondary  slide  in  the  main 
rudder  PCU  when  a  full  or  high-rate  input  is  applied  to  the  rudder  and  (2)  the  procedures 
training  necessary  to  cope  with  the  hazards. 

On  February  2,  1999,  the  Safety  Board  expressed  concern  about  the  amount  of 
time  that  elapsed  before  the  FAA  issued  FSIB  98-03;  the  FAA  had  anticipated  issuing  the 
bulletin  in  July  1997.  Nonetheless,  because  the  bulletin  met  the  intent  of  Safety 
Recommendation  A-97-17,  it  was  classified  “Closed— Acceptable  Action.” 

Safety  Recommendation  A-97-18  asked  the  FAA  to 

Require  the  Boeing  Commercial  Airplane  Group  to  develop  operational 
procedures  for  737  flight  crews  that  effectively  deal  with  a  sudden 
uncommanded  movement  of  the  rudder  to  the  limit  of  its  travel  for  any 
given  flight  condition  in  the  airplane's  operational  envelope,  including 
specific  initial  and  periodic  training  in  the  recognition  of  and  recovery 
from  unusual  attitudes  and  upsets  caused  by  reverse  rudder  response.  Once 
the  procedures  are  developed,  require  737  operators  to  provide  this  training 
to  their  pilots. 

On  April  18,  1997,  the  FAA  stated  that  AD  96-26-07,  which  was  issued  on 
December  23, 1996,  and  became  effective  on  January  17,  1997,  required  Boeing  to  revise 
its  AFM  to  include  procedures  that  would  enable  a  flight  crew  to  take  appropriate  action  to 
maintain  control  of  the  airplane  during  an  uncommanded  yaw  or  roll  condition  and  correct 
a  jammed  or  restricted  flight  control  condition.  The  FAA  also  stated  that  it  was  developing 
an  FSIB  to  meet  the  intent  of  this  recommendation. 

On  July  15,  1997,  the  Safety  Board  stated  that  issuance  of  AD  96-26-07  partly 
responded  to  the  intent  of  this  recommendation  but  neglected  a  critical  portion  of  the 
recommendation.  Specifically,  AD  96-26-07  did  not  address  specific  initial  and  periodic 
training  in  the  recognition  of  and  recovery  from  unusual  attitudes  and  upsets  caused  by 
reverse  rudder  response  or  require  737  operators  to  provide  this  training  to  their  pilots. 
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The  Safety  Board  continued  to  believe  that  pilots  must  receive  specific  initial  and  periodic 
training  if  they  are  expected  to  recover  the  airplane  if  a  reverse  rudder  response  results  in 
an  unusual  attitude.  Therefore,  pending  further  correspondence,  Safety  Recommendation 
was  classified  “Open — Unacceptable  Response.” 

On  January  29,  1998,  the  FAA  issued  FSIB  98-03,  “Recognition  of  and  Recovery 
From  Unusual  Attitudes  and  Upsets  Caused  by  Reverse  Rudder  Response  Involving 
Boeing  737s.”  The  FSIB  directs,  among  other  things,  that  FAA  inspectors  require  737 
operators  to  amend  their  training  programs  to  provide  initial  and  recurrent  training  in  the 
recognition  of  and  recovery  from  unusual  attitudes  and  upsets  caused  by  reverse  rudder 
response. 

On  February  2,  1999,  the  Safety  Board  stated  that  it  would  further  analyze  and 
discuss  Safety  Recommendation  A-97-18  in  the  US  Air  flight  427  accident  report.  The 
Board  indicated  that,  pending  the  analysis  and  discussion.  Safety  Recommendation 
A-97-18  remained  classified  “Open — Unacceptable  Response.”  The  Safety  Board’s 
evaluation  of  Safety  Recommendation  A-97-18  and  the  recommendation’s  current 
classification  are  discussed  in  section  2.7.2. 

1.18.12  Party  Submissions 

The  Safety  Board  received  party  submissions  that  discussed  possible  scenarios 
and/or  causes  for  the  USAir  flight  427  accident  from  the  FAA,  Boeing,  Parker  Hannifin, 
USAir,  and  ALPA. 

FAA  Submission 

The  FAA’s  September  1997  submission  stated: 

While  the  investigation  has  produced  evidence  which  support  the  scenarios 
where  the  rudder  moved  to  a  full-left  position  after  an  encounter  with  wake 
turbulence,  the  cause  of  the  movement  is  still  at  issue.  The  FAA  upon 
review  of  the  evidence,  cannot  conclude  that  a  failure  mode  which  resulted 
in  an  uncommanded  rudder  movement  on  Flight  427  has  been  identified. 

Any  causal  findings,  to  be  legitimate,  must  have  conclusive  evidence  to 
support  findings  of  a  hard  over  or  reversal  rudder.  Such  evidence  has  yet  to 
be  found.  Consequently,  a  specific  causal  finding  of  this  nature  may  not  be 
appropriate. 

The  rudder  system  abnormalities  that  have  been  discovered  during  this 
investigation  have  not  been  shown  to  have  occurred  on  USAir  flight  427. 

There  is  no  evidence  of  any  of  these  abnormalities  being  present  during  the 
accident  sequence.  While  the  FAA  acknowledges  the  fact  that  some  failure 
modes  of  the  main  rudder  power  control  unit  servo  valve  have  been 
discovered  during  this  accident  investigation,  it  has  not  been  substantiated 
that  any  of  these  failures  occurred  on  the  accident  aircraft.  The  FAA  also 
acknowledges  that  a  secondary  slide  jam  to  the  housing  of  the  servo  valve 
or  interference  with  the  rudder  input  link  could  provide  both  full  rudder 
rate  and  full  hinge  moment.  However,  once  again  there  is  no  direct 
evidence  that  this  occurred. 
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The  Boeing  Aircraft  Company  and  the  FAA  have  reacted  to  the  discovered 
failure  modes  with  modifications  of  the  rudder  system,  including  some 
recommended  by  the  National  Transportation  Safety  Board  that  are 
designed  to  prevent  future  events  of  this  type.  However,  the  FAA  does  not 
believe  sufficient  evidence  exists  to  establish  a  rudder  system  failure  as  the 
cause  of  the  accident. 

Boeing  Submissions 

During  the  investigation  of  the  USAir  flight  427  accident,  Boeing  provided  the 
Safety  Board  with  a  formal  submission  and  a  human  factors  supplement  (dated 
September  30,  1997),  a  supplemental  submission  (dated  August  14,  1998),  and  numerous 
letters  containing  what  might  be  considered  submittal  information.  Portions  of  these 
submittals  relating  to  Boeing’s  proposed  accident  scenarios  for  the  United  flight  585 
accident  and  the  Eastwind  flight  517  incident  and  Boeing’s  kinematic  and  simulation 
studies  are  discussed  in  sections  1.16.1  and  1.16.6,  respectively. 

Boeing’s  September  30,  1997,  submission  concluded  that  the  flight  crew  was 
startled  by  the  severity  of  an  unexpected  wake  encounter,  a  full  rudder  deflection 
occurred,  the  pilots  applied  aft  pressure  on  the  control  column,  and  the  airplane 
subsequently  entered  a  stall  and  remained  stalled  for  approximately  14  seconds  as  it 
descended  to  the  ground.  However,  the  submission  stated  that  the  events  that  led  to  the  full 
rudder  deflection  were  not  clear.  Boeing’s  September  1997  submission  stated,  “there  is  no 
certain  proof  of  airplane-caused  full  rudder  deflection  during  the  accident  sequence.  The 
previously  unknown  failure  conditions  that  have  been  discovered  in  the  737  rudder  PCU 
have  been  shown  to  not  be  applicable  to  Flight  427  or  any  other  conditions  experienced  in 
commercial  service.” 

Boeing’s  September  1997  submission  stated  the  following  probable  cause  of  the 
USAir  flight  427  accident: 

...there  is  no  evidence  to  support  a  conclusion  that  an  uncommanded  full 
rudder  deflection  occurred.  While  there  is  not  conclusive  evidence  of  a 
crew-commanded,  sustained  left-rudder  input  such  a  possibility  is  plausible 
and  must  be  seriously  considered,  especially  given  the  lack  of  evidence  of 
an  airplane-induced  rudder  deflection.” 

Boeing’s  September  1997  submission  also  stated  the  investigation  and  the  737 
design  review  identified  “areas  where  the  737  rudder  system  could  be  improved.  In 
addition,  extremely  unlikely  failure  modes  were  identified  that  could  hypothetically  result 
in  unwanted  rudder  deflections.”  The  submission  stated  that,  in  accordance  with  the  FAA’s 
ADs  97-14-03  and  97-14-04,  Boeing  pursued  several  rudder  system  design  changes, 
including  redesigns  of  the  main  rudder  PCU  servo  valve  and  the  yaw  damper  system,  new 
PCU  input  rod  fasteners,  and  the  design  and  installation  of  a  hydraulic  pressure  reducer. 

Boeing’s  September  1997  submission  further  stated  that  the  most  significant 
findings  from  the  investigation  included  the  following: 
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•  Commercial  transport  flight  crews  need  to  be  specifically  trained  to  handle 
large  upsets.  Transport  pilot  training  widely  used  in  the  1994  time  frame  did 
not  prepare  flight  crews  for  recovery  from  the  highly  unusual  roll  rates  and  roll 
and  pitch  attitudes  encountered  by  the  crew  of  Flight  427. 

•  737  yaw  damper  reliability  enhancements  are  needed  to  reduce  potential 
airplane  contribution  to  upsets. 

•  Highly  unlikely  potential  737  failure  modes  can  be  eliminated: 

•  Potential  737  rudder  PCU  failure  modes. 

•  Potential  737  rudder  PCU  input  rod  fastener  failure  mode. 

•  We  can  reduce  the  impact  of  either  airplane-related  or  crew-input-related 
rudder  upsets  by  limiting  737  rudder  control  authority. 

•  Research  is  needed  on  better  ways  to  detect  and  avoid  wake  vortices. 

•  Existing  737  flight  control  anomaly  procedures  could  be  improved. 

•  The  flight  data  recorder  information  from  this  accident  was  inadequate  to 
prove  definitive  events. 

Additionally,  Boeing’s  submission  recommended  that  “the  appropriate 
organizations  within  the  industry  take  steps  to  improve  industry  understanding  of  possible 
flight  crew  responses  to  wake  vortex  encounters  and  other  upset  events.  Boeing  believes 
that  such  an  effort  would  be  valuable  to  training  organizations  worldwide.” 

In  its  August  14,  1998,  supplemental  submission,  Boeing  stated  the  following 
regarding  its  analysis  of  the  Eastwind  flight  517  event: 

•  Multiple  scenarios  have  been  identified  that  match  at  least  some  of  the  data  and 
crew  reports  from  the  Eastwind  517  event.  None  of  the  scenarios  fully  match 
all  the  data,  kinematic  analysis,  and  crew  reports. 

•  Boeing  believes  that  under  the  NTSB’s  standard  for  identifying  “probable 
cause,”  there  is  insufficient  data  to  find  a  “probable  cause”  for  this  event. 

•  All  parties  generally  agree  that  the  initiation  of  the  Eastwind  event  included 
some  form  of  activity  from  the  yaw  damper  system. 

•  The  most  likely  explanation  for  the  Eastwind  event  involves  a  preexisting  yaw 
damper  fault  that  subsequently  cleared  itself. 

•  There  is  no  data  to  indicate  that  the  Eastwind  Flight  517  event,  the  United 
Flight  585  accident,  and  US  Air  Flight  427  accident  were  caused  by  a  common 
airplane  malfunction. 

Parker  Hannifin  Submission 

Parker  Hannifin’s  September  1997  submission  stated  that  the  postaccident 
examination  of  the  USAir  flight  427  PCU  revealed  no  physical  evidence  of  a  jam  or  other 
anomaly.  Further,  the  submission  stated  that  “the  conclusion  reached  by  Boeing  was  that 
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the  accident  PCU  would  not  seize  if  subject  to  thermal  shocks  or  temperature  differential 
consistent  with  those  which  could  be  encountered  in  realistic  flight  conditions.” 

Parker’s  submission  concluded 

A  significant  indication  of  the  reliability  of  the  main  rudder  PCU  from 
Flight  427  is  a  comparison  of  the  performance  of  the  unit  at  the  time  of  its 
original  manufacture  in  1987  as  measured  by  the  acceptance  test,  its 
performance  at  the  time  of  its  testing  during  removal  from  service  in 
September  1992,  its  performance  when  tested  immediately  following  the 
accident  the  September  1994,  and  finally,  its  performance  when  tested  in 
August  1997  after  having  been  subject  to  numerous  tests  and  conditions 
outside  the  normal  flight  environment  of  the  unit.  In  each  of  these 
instances,  the  PCU  consistently  operated  normally  and  within 
specifications.  In  sum,  after  years  of  one  of  the  most  critical  examinations 
in  aviation  history,  there  is  no  evidence  that  the  main  rudder  PCU  from 
Flight  427  malfunctioned  or  was  other  than  fully  operational. 

USAir  Submissions 

US  Air  provided  the  Safety  Board  with  a  submission  (dated  September  30,  1997) 
and  a  supplemental  submission  (dated  August  12,  1998).  In  its  September  30,  1997 
submission,  USAir  stated  that  “data  demonstrates,  and  all  parties  seem  to  agree,  that 
USAir  flight  427’s  rudder  moved  to  a  full-left  position  shortly  after  the  aircraft 
encountered  wake  vortices  generated  by  a  preceding  aircraft.  It  is  also  clear  that  the  wake 
vortex  encounter  did  not  directly  cause  the  accident.”  The  USAir  submission  described  the 
background  and  experience  of  the  pilots  and  their  actions  during  the  emergency  and 
concluded  the  following: 

[The  pilots]  did  not  apply  full-left  rudder  during  the  wake  vortex  encounter, 
oppose  it  with  opposite  aileron  and  spoiler,  and  hold  these  cross-controlled 
positions  for  23  seconds  as  the  aircraft  spiraled  into  the  ground.  The 
investigation  did,  however,  reveal  several  anomalies  in  the  Boeing  737 
rudder  control  system  that  may  have  caused  the  aircraft’s  rudder  to  fully 
deflect  without  crew  input  or  to  move  opposite  to  the  crew’s  input. 

The  USAir  submission  concluded  that  the  probable  cause  of  the  accident  was  “an 
uncommanded,  full  rudder  deflection  or  rudder  reversal  that  placed  the  aircraft  in  a  flight 
regime  from  which  recovery  was  not  possible  using  known  recovery  procedures.  A 
contributing  cause  of  this  accident  was  the  manufacturer’s  failure  to  advise  operators  that 
there  was  a  speed  below  which  the  aircraft’s  lateral  control  authority  was  insufficient  to 
counteract  a  full  rudder  deflection.” 

In  its  August  12,  1998,  supplemental  submission,  USAir  supported  the  results  of 
the  Safety  Board’s  simulation  studies.  USAir’s  supplemental  submission  indicated  that  “a 
mechanical  malfunction  of  USAir  flight  427  rudder  PCU  resulted  in  a  rudder  reversal  or 
uncommanded  deflection  that  caused  USAir  flight  427  to  depart  controlled  flight  and 
crash.”  USAir  also  restated  its  previous  conclusions. 
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ALPA  Submissions 

AT  PA  provided  the  Safety  Board  with  a  submission  (dated  September  1997)  and  a 
supplemental  submission  (dated  August  7,  1998)  in  which  it  offered  its  conclusions  and 
recommendations.  ALPA’s  September  1997  submission  stated  that 

...aircraft  performance  analysis  revealed  that  the  maneuver  of  US  Air  427 
is  consistent  with  full  nose  left  rudder  travel....  There  is  no  evidence  to 
support  the  hypothesis  that  the  flightcrew  mishandled  the  flight  control 
following  the  upset  event,  or  that  this  control  mishandling  led  to  the 
accident. 

As  for  the  B737  rudder  control  system  however,  during  the  course  of  this 
investigation  a  number  of  failure  modes  have  been  identified  which  could 
result  in  an  uncommanded  full  rudder  input.  It  was  also  discovered  that  at 
least  one  failure  mode,  secondary  valve  jam  resulting  in  primary  valve 
overtravel,  would  not  leave  witness  marks.  In  addition,  this  failure  mode 
resulted  in  rudder  movement  that  matched  the  rudder  time  history,  in  both 
magnitude  and  input  rate,  determined  from  the  aircraft  performance  studies 
necessary  to  match  the  maneuver. 

ALPA’s  submission  concluded  that 

...the  airplane  experienced  an  uncommanded  full  rudder  deflection.  This 
deflection  was  a  result  of  a  main  rudder  power  control  unit  (PCU) 
secondary  valve  jam  which  resulted  in  a  primary  valve  overstroke.  This 
secondary  valve  jam  and  primary  valve  overstroke  caused  USAir  427  to 
roll  uncontrollably  and  dive  into  the  ground.  Once  the  full  rudder  hardover 
occurred,  the  flight  crew  was  unable  to  counter  the  resulting  roll  with 
aileron  because  the  B737  does  not  have  sufficient  lateral  control  authority 
to  balance  a  full  rudder  input  in  certain  areas  of  the  flight  envelope. 

Additionally,  ALPA’s  submission  offered  the  following  recommendations  for  the 
Safety  Board’s  consideration: 

•  Boeing  and  Parker  should  work  diligently  to  replace  existing  B737  rudder 
PCUs  with  improved  units  as  quick  as  possible  without  sacrificing  quality. 

•  The  FAA  should  eliminate  the  current  practice  of  derivative  certification. 
Newly  developed  aircraft  should  be  carefully  evaluated  against  FAR  criteria  in 
place  at  the  time  of  aircraft  development. 

•  For  aircraft  which  were  certificated  as  “Derivative”  models,  the  FAA  should 
evaluate  those  aircraft  against  existing  FAR  requirements  and  those  aircraft,  to 
the  extent  feasible,  should  be  modified  in  order  to  be  in  compliance  with  the 
current  FAR  regulations. 

•  The  FAA  should  require  all  FAA  certified  repair  stations  to  meet  all  standards 
of  the  original  equipment  manufacturer. 
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•  In  order  to  increase  B737  lateral  control  margin  to  an  acceptable  level,  the 
FAA  should  mandate  the  development  of  additional  operational  techniques 
such  as  increasing  B737  minimum  maneuvering  speed  to  Boeing 
recommended  “Block”  speed  plus  10  knots. 

•  The  industry  should  continue  with  the  development  and  implementation  of 
“Advanced  Maneuver”  or  “Selected  Event”  training  and  that  the  FAA  should 
require  the  inclusion  of  this  training  in  every  airline’s  training  program. 

In  the  August  7, 1998,  supplemental  submission,  ALFA  noted  that  a  comparison  of 
Boeing’s  kinematic  analysis  and  the  Safety  Board’s  computer  simulation  of  the  Eastwind 
flight  517  event  indicated  that 

...both  scenarios  match  the  same  recorded  [FDR]  data,  demonstrating  that 
it  is  possible  to  match  the  maneuver  with  different  scenarios  by  varying  the 
assumption  and  interpretation  of  the  course  data.  However,  ALFA  believes 
that  the  Board  is  more  accurate  in  their  scenario  since  the  rate  of  the  rudder 
input  required  to  match  the  maneuver  is  the  same  rate  which  would  result 
from  a  FCU  secondary  valve  jam. 

NTSB  staff,  using  [its]  simulation,  has  also  been  able  to  match  both  the 
USAir  [flight]  427,  and  [United  flight]  585  accident  upsets  by  assuming  a 
FCU  secondary  valve  jam.  In  all  three  cases  the  rudder  input  rate  needed  to 
match  flight  recorder  data  is  consistent  with  the  rudder  rate  which  would 
result  from  a  secondary  valve  jam.  It  is  extremely  unlikely  that  three 
different  pilots  in  three  different  B737s,  on  three  different  days  would  use 
the  same  rudder  rate.  Yet  if  the  secondary  valve  were  jammed  in  each  case, 
it  would  result  in  the  same  rudder  input  rate. 

The  supplemental  submission  concluded  that  “ALFA  believes  more  strongly  than 
ever  that  the  cause  of  the  accident  was  a  rudder  anomaly.” 

1.19  New  investigative  Techniques 

The  extent  of  the  destruction  involved  the  USAir  flight  427  accident  and  the 
complexity,  depth,  and  duration  of  the  accident  investigation  resulted  in  the  use  of  some 
new  techniques  and  practices.  After  its  initial  examination  of  the  accident  site,  the  Safety 
Board  (in  cooperation  with  local  public  safety  officials)  determined  that  the  accident  site 
and  the  airplane  wreckage  and  components  were  a  potential  biological  hazard.  As  a  result, 
the  Board  required  the  use  of  personal  protective  equipment  (FFE)  and  the 
implementation  of  safety  procedures,  as  outlined  in  the  Occupational  Safety  and  Health 
Administration  (OSHA)  regulations  contained  in  29  CFR  Fart  1910.  During  the  on-scene 
investigation,  the  Safety  Board  (with  assistance  from  other  emergency  response 
authorities)  established  formal  procedures  for  the  large-scale  provision,  use,  and 
disposition  of  FFE;^®^  the  distribution  of  Hepatitis  B  inoculations  to  all  noninoculated 


The  OSHA  procedures  for  this  type  of  environment  required  all  investigative  and  emergency 
response  personnel  to  wear  PPE  when  they  accessed  those  areas  of  the  accident  site  containing  biological 
hazards  and  undergo  decontamination  procedures  after  departing  the  biohazard  area. 
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on-scene  investigative/emergency  response  personnel;  and  the  decontamination  of  every 
recovered  piece  of  airplane  wreckage. 

The  monitoring  of  and  access  control  to  the  accident  site  was  initially  the 
responsibility  of  the  Hopewell  Township  emergency  response  personnel,  with  support 
from  neighboring  jurisdictions,  the  Beaver  County  Sheriff’s  Office,  and  the  Pennsylvania 
State  Police.  A  Unified  Command  Post  (UCP)  was  subsequently  established,  and  the 
responsibility  for  control  and  coordination  of  site  access,  PPE,  decontamination,  and  other 
site  logistics  came  under  the  purview  of  UCP  authorities.  The  UCP  included 
representatives  from  the  Safety  Board,  the  U.S.  Air  National  Guard,  the  USAF  Reserve, 
Pennsylvania  Emergency  Management  Agency,  Pennsylvania  Department  of 
Environmental  Resources,  Pennsylvania  State  Police,  Beaver  County  Sheriff’s  and 
Coroner’s  Offices,  and  Hopewell  Township  Fire  and  Police  Departments.  Other  groups 
involved  in  the  UCP  were  the  American  Red  Cross,  the  Salvation  Army,  and  a  University 
of  Pittsburgh  Critical  Incident  Stress  Debriefing  team. 

Because  of  the  catastrophic  destruction  of  the  airplane  and  occupants,  the  Safety 
Board  sought  assistance  from  the  AFIP  in  positively  identifying  the  flight  crews’  remains. 
AFIP  personnel  used  deoxyribonucleic  acid  (DNA)  protocols  to  identify  and  differentiate 
the  muscle  tissue  samples  obtained  from  the  cockpit  area  of  the  wreckage.  With  the  use  of 
DNA  protocols  and  reference  specimens  from  the  first  officer’s  family,  AFIP  personnel 
were  able  to  positively  identify  one  set  of  tissue  samples  as  the  first  officer’s  remains.  The 
Safety  Board  was  unable  to  obtain  reference  specimens  from  the  captain’s  family. 
However,  the  FBI  identified  footprints  from  tissue  specimens  recovered  from  the  cockpit 
area,  and  these  footprints  matched  those  of  the  captain’s  USAF  footprint  records.^^  With 
the  use  of  the  footprints  and  DNA  tests,  the  captain’s  remains  were  positively  identified. 

Because  the  accident  airplane  impacted  the  ground  at  a  high  airspeed,  the  Safety 
Board  became  concerned  that  important  airplane  components  might  have  penetrated  the 
ground  and  might  not  be  easily  located  and  recovered.  To  locate  any  components  under 
the  surface,  the  U.S.  Bureau  of  Mines  provided  Safety  Board  investigators  with  a  GPR 
system,  metal  detectors,  and  researchers  to  operate  the  equipment.  A  GPR  search  of  the 
area  was  conducted  after  most  of  the  airplane  wreckage  had  been  removed  from  the 
accident  site  to  the  hangar  at  PIT.  The  GPR  equipment  detected  pieces  of  wreckage  that 
had  penetrated  up  to  6  feet  deep  in  the  soil;  these  wreckage  components  were 
subsequently  recovered  and  moved  to  the  hangar.  This  accident  was  the  first  time  that  a 
GPR  system  was  used  during  a  Safety  Board  investigation;  the  system  was  subsequently 
used  during  the  Safety  Board’s  on-scene  investigation  of  the  aircraft  accident  involving 
ValuJet  flight  592,  which  occurred  in  the  Everglades,  near  Miami,  Florida,  on  May  11, 
1996.^®'* 


The  USAF  documented  the  captain’s  footprints  when  he  was  involved  in  its  pilot  training  program. 

National  Transportation  Safety  Board,  1997.  In-Flight  Fire  and  Impact  with  Terrain,  ValuJet  Airlines 
Flight  592,  DC-9-32,  N904VJ,  Everglades,  Near  Miami,  Florida,  May  11,  1996.  Aircraft  Accident  Report 
NTSB/AAR-97/06.  Washington,  DC. 
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Another  practice  that  the  Safety  Board  used  for  the  first  time  during  an 
investigation  was  the  establishment  of  an  independent  technical  advisory  panel  (see 
section  1.18.2)  to  review  the  work  performed  by  the  Safety  Board’s  investigative  team  and 
propose  additional  tests  and  scenarios  for  investigation.  This  collaborative  effort  helped 
the  Safety  Board  test  for  and  identify  the  main  rudder  PCU  thermal  jam  rudder  reversal 
scenario. 


/ 


Analysis 


240 


Aircraft  Accident  Report 


2.  Analysis 


2.1  General 

The  USAir  flight  427  flight  crew  was  properly  certificated  and  qualified  and  had 
received  the  training  and  off-duty  time  prescribed  by  Federal  regulations.  No  evidence 
indicated  any  preexisting  medical  or  behavioral  conditions  that  might  have  adversely 
affected  the  flight  crew’s  performance  during  the  accident  flight. 

The  USAir  flight  427  accident  airplane  was  equipped,  maintained,  and  operated  in 
accordance  with  applicable  Federal  regulations.  The  airplane  was  dispatched  in 
accordance  with  FAA-  and  industry-approved  practices. 

On  the  basis  of  postaccident  examination  of  the  wreckage  and  identification  of  all 
fuselage  doors,  door  frames,  and  locking  mechanisms,  the  Safety  Board  concludes  that  all 
of  USAir  flight  427’s  doors  were  closed  and  locked  at  impact. 

The  catastrophic  impact  with  terrain,  postimpact  fire,  and  subsequent  destruction 
of  the  airplane  precluded  a  complete  inventory  of  the  airplane’s  structure  and  components. 
However,  all  recovered  structural  pieces  were  examined  thoroughly  by  fire  and  explosion 
experts  from  the  Safety  Board,  FAA,  FBI,  and  the  United  Kingdom’s  Air  Accidents 
Investigation  Branch.  Additionally,  the  Safety  Board  examined  the  CVR  and  FDR 
information  from  the  accident  airplane  and  compared  it  with  FDR  information  obtained 
from  the  investigation  into  the  accident  involving  Pan  Am  flight  103  over  Lockerbie, 
Scotland,  and  other  known  in-flight  fire,  bomb,  and  explosion  events.  These  examinations 
revealed  no  evidence  of  an  in-flight  fire,  bomb,  or  explosion. 

Also,  more  than  100  witnesses  on  the  ground  were  interviewed,  and  all  but 
1  reported  that  the  airplane  appeared  to  be  intact  during  the  accident  sequence.  The  Safety 
Board  nonetheless  conducted  a  series  of  postaccident  ground  and  helicopter  searches. 
Although  the  search  did  not  reveal  any  significant  airplane  components  located  away  from 
the  main  wreckage,  light-weight  pieces  from  the  airplane  (for  example,  insulation  and 
paper)  were  located  as  far  as  2.5  miles  downwind  from  the  accident  site.  On  the  basis  of 
witness  statements,  physical  evidence  from  the  wreckage,  and  the  prevailing  winds  at  the 
time  of  the  accident,  the  Safety  Board  considers  it  likely  that  those  light-weight  airplane 
pieces  became  airborne  as  a  result  of  the  postimpact  explosion  and  fire  and  then  drifted 
downwind  from  the  accident  site.  The  extremities  of  the  airplane  and  all  flight  control 
surfaces  were  found  at  the  main  wreckage  site.  Further,  no  evidence  indicated  that 
material  fatigue  or  corrosion  contributed  to  the  accident. 

On  the  basis  of  the  findings  discussed  in  the  previous  two  paragraphs,  the  Safety 
Board  concludes  that  USAir  flight  427  did  not  experience  an  in-flight  fire,  bomb, 
explosion,  or  structural  failure. 
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A  review  of  ATC  procedures  and  radar  information  revealed  that  the  air  traffic 
controllers  followed  applicable  air  traffic  and  wake  turbulence  separation  rules  and  that 
the  required  air  traffic  separation  was  maintained  during  flight  427 ’s  approach  to  the 
Pittsburgh  International  Airport  (PIT).  The  accident  airplane  and  the  Boeing  727  airplane 
that  preceded  it  inbound  to  PIT  (Delta  flight  1083)  were  separated  by  at  least  4.1  miles 
when  they  were  at  the  same  altitude 

The  Safety  Board  considered  the  possibility  that  a  midair  collision  with  an  airplane 
or  birds  was  involved  in  the  accident  scenario.  However,  examination  of  the  airplane 
wreckage;  CVR,  FDR,  and  radar  data;  and  statements  from  ATC  personnel  and  witnesses 
on  the  ground  revealed  no  evidence  that  an  impact  with  other  air  traffic  or  a  bird  strike 
were  involved  in  the  accident. 

The  Safety  Board  also  considered  the  possible  role  of  weather  in  the  accident. 
However,  weather  and  FDR  information  and  statements  from  witnesses  on  the  ground  and 
the  pilots  of  other  airplanes  operating  in  the  area  indicated  that,  at  the  time  of  the  accident 
flight’s  upset/loss  of  control,  the  weather  in  the  Pittsburgh  area  was  clear  with  light  winds. 
No  evidence  indicated  that  clear  air  turbulence  or  other  atmospheric  phenomena  were 
involved  in  the  accident.  Accordingly,  the  Safety  Board  concludes  that  a  midair  collision 
with  other  air  traffic,  a  bird  strike,  clear  air  turbulence,  or  other  atmospheric  phenomena 
were  not  involved  in  the  USAir  flight  427  accident. 

2.2  USAir  Flight  427  Upset 

The  accident  flight  was  apparently  routine  until  it  neared  PIT.  FDR  data  indicated 
that,  about  1902:54,  the  accident  airplane  was  rolling  out  of  a  left  bank  to  its  assigned 
heading  of  100°,  after  which  it  began  to  yaw  and  roll;  about  1902:59,  the  airplane’s 
heading  moved  left  past  100°  at  an  increasing  rate.  By  1903:01,  the  airplane’s  heading 
was  moving  left  at  a  rate  of  at  least  5°  per  second;  the  airplane’s  heading  continued  to 
move  left  at  least  at  this  rate  until  the  stickshaker  activated  about  1903:08.  The  airplane’s 
left  roll  angle  was  also  increasing  rapidly  during  this  time;  about  1903:01  the  airplane’s 
left  roll  angle  was  about  28°,  and  5  seconds  later  (at  1903:06)  the  airplane’s  left  roll  angle 
exceeded  70°.  The  Safety  Board  therefore  considered  various  scenarios  that  could  have 
resulted  in  such  a  heading  change,  including  the  following:  (1)  asymmetric  engine  thrust 
reverser  deployment,  (2)  asymmetrical  spoiler/aileron  activation,  (3)  transient  electronic 
signals  causing  uncommanded  flight  control  movements,  (4)  yaw  damper  malfunctions, 
and  (5)  a  rudder  cable  break  or  pull.  The  Safety  Board  ruled  out  each  of  these  scenarios  as 
a  possible  factor  or  cause  of  the  left  yaw/roll  and  heading  change  for  the  following 
reasons: 
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•  Postaccident  examination  of  the  engine  thrust  reversers,  including  disassembly 
of  the  thrust  reverser  actuators,  indicated  that  the  engine  thrust  reversers  were 
in  the  stowed  position  at  impact.  Further,  the  investigation  revealed  that,  at  the 
engine  power  settings  recorded  by  the  FDR  during  the  upset  event,  a  thrust 
reverser  deployment  would  not  have  produced  a  heading  change  that  would 
match  the  FDR  heading  data  and  would  have  produced  longitudinal 
acceleration  signatures  that  were  not  reflected  by  the  FDR  longitudinal 
acceleration  data. 

•  Simulator  tests  indicated  that  even  the  most  adverse  asymmetrical  spoiler/ 
aileron  extension  condition  could  not  create  a  heading  change  rate  of  the 
magnitude  that  was  recorded  by  the  accident  airplane’s  IDR. 

•  The  Safety  Board  examined  the  possibility  that  transient  electronic  signals, 
possibly  caused  by  blue  water  contamination  of  components  in  the  electrical/ 
electronic  compartment  (E/E  bay),^°^  high-intensity  radiated  field  (HIRF) 
interference,  or  electromagnetic  interference  (EMI)  could  result  in  an 
uncommanded  flight  control  movement.  Although  the  Boeing  737  flight 
controls  are  primarily  hydromechanical  (not  electrical),  there  are  electrical 
links  to  the  flight  control  systems  through  the  autopilot  (which  interfaces  with 
the  ailerons,  spoilers,  elevators,  and  stabilizer  trim  but  not  the  rudder),  the 
rudder  trim,  and  the  rudder  system’s  yaw  damper.  Therefore,  EMI  and/or 
HIRF  could  theoretically  affect  the  autopilot,  rudder  trim,  and/or  yaw  damper 
systems  within  the  limits  of  those  systems.  Further,  the  autopilot  and  yaw 
damper  systems  have  components  located  in  the  E/E  bay  and  therefore  could 
have  been  affected  by  fluid  contamination. 

I 

•  The  Safety  Board’s  flight  tests  and  review  of  event  histories  demonstrated, 
however,  that  pilots  could  easily  override  uncommanded  movements  of  the 
ailerons,  spoilers,  or  elevators  resulting  from  electronic  signals  influencing 
those  flight  controls.  If  such  an  uncommanded  flight  control  movement 
persisted,  a  pilot  could  easily  disengage  the  autopilot  (as  the  pilots  of  USAir 
flight  427  ultimately  did),  thus  likely  eliminating  the  electrical/electronic 
influence  on  the  flight  controls.  In  addition,  postaccident  examination  of  the 
rudder  trim  system  components  indicated  that  the  rudder  trim  actuator  was  in 
the  neutral  position  at  impact.  If  the  rudder  trim  actuator  were  disturbed  by  a 
transient  electrical  input,  it  would  have  remained  in  its  trimmed  position  until  it 
was  trimmed  again  by  specific  pilot  action — unlike  the  rudder  PCU,  which 
would  revert  to  its  neutral  position  when  pilot  or  yaw  damper  input  ceased  and 
was  found  in  a  near-neutral  position  at  the  accident  site.  Further,  because  the 
rudder  trim  system  moves  the  rudder  at  a  much  slower  rate  than  the  rudder 
system  or  the  yaw  damper  (0.5°  versus  66  and  50°  per  second,  respectively). 


Although  postaccident  examination  of  recovered  portions  of  the  forward  lavatory/galley  and  E/E  bay 
revealed  no  evidence  of  blue  water  contamination,  such  contamination  may  have  existed  on  portions  of 
those  structures  that  were  not  recovered  or  identified. 
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it  could  not  produce  a  rudder  deflection  rate  that  would  result  in  the  rapid 
yawing  motion  and  heading  change  observed  in  the  FDR  and  computer 
simulation  data. 

•  A  review  of  the  yaw  damper  system  indicated  that  it  could  not  produce  a 
rudder  deflection  that  would  result  in  the  yawing  motion  observed  in  the  FDR 
data  because  the  yaw  damper  system  authority  is  limited  to  ±  3°  (when 
properly  rigged).  Simulator  tests  confirmed  that  these  limited  rudder 
deflections  could  not  result  in  the  yawing  motion  observed  in  the  accident 
airplane’s  FDR  data.  Further,  pilot  statements  describing  uncommanded  yaw 
excursions  within  the  yaw  damper  system’s  normal  range  (±  3°)  indicated  that 
such  excursions  are  typically  considered  to  be  merely  nuisance  events  and  are 
easily  controlled  by  the  flight  crew.  Additionally,  as  with  the  autopilot,  the 
pilots  could  have  easily  disengaged  the  yaw  damper  system  if  necessary,  thus 
eliminating  the  yaw  damper’s  effect. 

•  The  Safety  Board  considered  the  possibility  of  a  yaw  damper  failure  in 
combination  with  a  jam  of  the  standby  rudder  PCU  input  bearing.  Tests 
showed  that  such  a  combination  could  result  in  a  rudder  deflection  of  about  9°. 
However,  this  rudder  deflection  could  not  have  produced  the  heading  change 
recorded  by  the  accident  airplane’s  FDR.  Further,  the  Safety  Board’s  tests  also 
showed  that  a  pilot  input  on  the  rudder  pedals  could  override  this  combined 
failure/jam  and  neutralize  the  rudder. 

•  Testing  examined  the  possibility  that  a  rudder  cable  pull  or  break  might  have 
caused  the  heading  change.  However,  the  tests  demonstrated  that  the  effects  of 
loads  up  to  250  pounds  applied  to  the  rudder  cables  could  produce  maximum 
rudder  deflections  of  only  2.3°  and  that  rudder  cable  separations  could  produce 
maximum  rudder  surface  deflections  of  only  5°.  Simulator  tests  indicated  that 
such  rudder  deflections  would  not  create  a  yawing  motion  or  heading  change 
of  the  magnitude  that  was  recorded  by  the  accident  airplane’s  FDR.  In 
addition,  when  the  rudder  cables  were  cut  during  postaccident  tests,  the  CVR 
recorded  “bang”  sounds  that  had  energy  distributed  throughout  the  frequency 
spectrum,  with  multiple  secondary  signals  that  appeared  to  be  the  result  of 
mechanical  “ringing”  of  the  rudder  cable  system.  These  sounds  and 
frequencies  did  not  resemble  any  of  the  sounds  or  frequencies  recorded  by  the 
CVR  during  the  upset/loss  of  control  of  USAir  flight  427. 

Therefore,  the  Safety  Board  concludes  that  asymmetrical  engine  thrust  reverser 
deployment,  asymmetrical  spoiler/aileron  activation,  transient  electronic  signals  causing 
uncommanded  flight  control  movements,  yaw  damper  malfunctions,  and  a  rudder  cable 
pull  or  break  were  not  factors  in  the  USAir  flight  427  accident. 

The  accident  investigation  revealed  that,  when  the  airplane  began  to  yaw  and  roll 
left  (as  it  penetrated  the  path  of  the  descending  wake  of  Delta  flight  1083),  the  FDR  began 
to  record  load  factor  fluctuations  and  an  increase  in  airspeed.  These  airplane  motions 
were  consistent  with  the  performance  changes  that  were  observed  during  the  Safety 
Board’s  wake  turbulence  flight  tests.  Further,  the  “thump”  sounds  recorded  by  the 
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accident  airplane’s  CVR  during  the  following  6  seconds  (while  the  airplane  was  still  likely 
passing  through  the  727’s  wake  vortices)  were  similar  to  the  sounds  recorded  by  the  flight 
test  airplane’s  CVR  when  the  wake  vortices  passed  across  the  test  airplane’s  fuselage. 
(These  sounds  were  described  by  flight  test  pilots  as  “whooshing”  noise. 

The  Safety  Board  considered  the  possibility  that  the  wake  turbulence  encounter 
alone  resulted  in  the  accident  airplane’s  heading  change  and  the  subsequent  upset  event 
and  accident.  However,  wake  turbulence  flight  test  data  and  flight  test  pilot  statements 
indicated  that  it  was  not  difficult  to  recover  from  the  wake  vortex  encounters,  although 
some  encounters  resulted  in  rolling  moments  that  were  surprisingly  intense  (especially 
those  in  which  the  intercept  angle  was  small  and  the  vortex  impacted  the  airplane’s 
fuselage,  as  most  likely  occurred  with  the  accident  airplane).  Further  review  of  the  wake 
turbulence  flight  test  data  did  not  reveal  any  instances  in  which  the  wake  vortex  encounter 
resulted  in  a  heading  change  resembling  that  recorded  by  the  accident  airplane’s  FDR.  In 
most  of  the  flight  test  encounters,  the  airplane  rapidly  exited  the  wake  vortex,  thus  ending 
the  encounter.  In  fact,  the  wake  turbulence  flight  tests  indicated  that  wake  vortices 
naturally  tended  to  push  the  airplane  out  of  the  wake’s  effects. 

Additionally,  the  Safety  Board’s  review  of  wake  turbulence-related  events  in  its 
accident  and  incident  database^®^  and  in  NASA’s  Aviation  Safety  Reporting  System 
revealed  that,  although  air  carrier  pilots  frequently  reported  being  surprised  by  the  severity 
of  wake  vortex  encounters,  these  encounters  typically  resulted  in  upsets  that  pilots  were 
easily  able  to  counter.  The  Safety  Board’s  database  indicated  that  wake  turbulence 
encounters  were  determined  to  be  causal  factors  in  three  air  carrier  accidents.  These  three 
accidents,  which  occurred  between  1964  and  1972,  involved  airplanes  operating  at  low 
altitudes  near  airports  (two  airplanes  were  landing,  and  one  was  taking  off).  After  the 
1972  accident,  ATC  airplane  separation  standards  were  increased;  since  that  time,  no 
fatalities  aboard  air  carrier  airplanes  have  involved  a  wake  turbulence  encounter.  Notably, 
no  record  exists  of  a  catastrophic  encounter  with  wake  turbulence  by  an  air  carrier  airplane 
when  the  airplane  was  operating  at  altitudes  and/or  airspeeds  similar  to  those  of  USAir 
flight  427. 

Evidence  of  wake  vortex-related  airplane  motions  were  detected  in  the  accident 
airplane’s  FDR  data  by  about  1902:55.  However,  the  results  of  the  wake  vortex  flight  tests 
and  the  Safety  Board’s  computer  simulations  indicate  that  the  airplane  would  not  have 
remained  in  the  wake  long  enough  to  have  produced  the  heading  change  and  bank  angles 
that  occurred  after  1903:00.  On  the  basis  of  the  results  of  wake  turbulence  flight  tests  and 
flight  simulator  sessions  and  review  of  available  wake  turbulence  event  information,  the 


^  Boeing’s  flight  test  pilot  reported  that,  during  some  of  the  wake  vortex  encounters,  he  heard  a 
clicking  sound  that  he  attributed  to  the  wake  vortices  causing  the  windshield  wipers  to  slap  against  the 
windshield.  At  1902:58.6,  the  USAir  flight  427  CVR  recorded  a  “clickety  click”  sound,  the  source  of  which 
could  not  be  positively  identified.  Although  the  Safety  Board  reviewed  the  sounds  recorded  by  the  CVR  on 
50  of  the  150  wake  turbulence  flight  test  conditions,  it  did  not  identify  a  case  in  which  the  CVR  recorded 
such  a  clickety  click  sound.  Therefore,  no  direct  comparison  was  possible  between  the  sounds  heard  on  the 
flight  test  airplane  and  the  accident  airplane. 

The  Safety  Board’s  database  contains  information  regarding  aviation  accidents  beginning  in  1962. 
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Safety  Board  concludes  that,  although  USAir  flight  427  encountered  turbulence  from 
Delta  flight  1083 ’s  wake  vortices,  the  wake  vortex  encounter  alone  would  not  have  caused 
the  continued  heading  change  that  occurred  after  1903:00. 

Boeing  and  Safety  Board  flight  and  computer  simulations  (discussed  in  section 
1.16.6.1)  have  demonstrated,  however,  that  the  heading  change  rates  recorded  by  the  FDR 
after  1903:00  were  consistent  with  the  rudder  being  deflected  to  its  left  aerodynamic 
blowdown  limit.  Accordingly,  the  Safety  Board  concludes  that,  about  1903:00,  USAir 
flight  427’s  rudder  deflected  rapidly  to  the  left  and  reached  its  left  aerodynamic  blowdown 
limit  shortly  thereafter.  This  movement  of  the  airplane’s  rudder  could  only  have  been 
caused  by  a  flight  crew  action  or  a  mechanical  rudder  system  anomaly. 

The  potential  for  such  a  mechanical  rudder  anomaly  was  demonstrated  during 
postaccident  tests  in  which  the  secondary  slide  was  intentionally  jammed  (pinned)  to  the 
servo  valve  housing  and  a  rapid  input  was  applied  in  a  direction  that  would  oppose  the 
jam.  These  tests  showed  that  the  primary  slide  could  overtravel resulting  in  hydraulic 
fluid  porting  in  such  a  way  that  the  rudder  moves  to  its  aerodynamic  blowdown  position  in 
the  direction  opposite  to  the  rudder  input  (rudder  reversal).^®’ 

Further,  during  the  most  severe  postaccident  thermal  tests  (a  temperature 
difference  of  about  180°  between  the  heated  hydraulic  fluid  and  the  servo  valve  housing  of 
the  USAir  flight  427  main  rudder  PCU),  the  secondary  slide  jammed  to  the  servo  valve 
housing,  and  hydraulic  fluid  flow  data  indicated  that  a  momentary  reversal  of  the  rudder 
occurred  during  this  jam.  Although  the  USAir  flight  427  servo  valve  jammed  repeatedly 
during  these  extreme  thermal  tests,  the  new-production  servo  valve  also  subjected  to  these 
tests  never  jammed.  Examination  of  the  internal  measurements  of  both  servo  valves 
indicated  that  the  USAir  flight  427  servo  valve  had  significantly  tighter  diametrical 
clearances  between  the  secondary  slide  and  the  servo  valve  housing  than  the  new- 
production  servo  valve.  The  Safety  Board  considers  it  likely  that  the  USAir  flight  427 
servo  valve  was  more  susceptible  to  a  jam  because  of  its  tighter  clearances. 

Although  the  USAir  flight  427  main  rudder  PCU  servo  valve  had  been  subjected  to 
impact  forces  from  the  accident  and  extensive  postaccident  testing  (including  repeated 
thermal  jams),  internal  examination  of  the  servo  valve  revealed  no  evidence  of  physical 
marks  that  would  indicate  that  a  jam  had  existed.  Further,  the  servo  valve  slides  still 
moved  freely,  and  the  servo  valve  was  still  capable  of  successfully  completing  Parker 
Hannifin’s  acceptance  test  procedure  functional  tests. 

The  Safety  Board  recognizes  that  the  temperature  differential  to  which  the  accident 
PCU  servo  valve  was  exposed  under  the  most  severe  thermal  test  conditions  was  greater 
than  that  expected  in  normal  operation;  the  hydraulic  fluid  had  not  been  circulating 
through  the  PCU  before  the  tests  began  and  was  therefore  not  continuously  warming  the 


This  overtravel  is  the  result  of  elastic  deformation  of  the  mechanical  input  mechanisms  that  allow  the 
primary  slide  to  move  beyond  its  intended  design  limits. 

Normally,  if  the  secondary  slide  were  to  jam  to  the  PCU  servo  valve  housing,  the  primary  slide 
would  move  to  oppose  the  jam,  neutralizing  hydraulic  flow. 
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PCU  servo  valve  housing  as  it  would  be  in  flight  if  the  yaw  damper  were  energized.^*® 
Nonetheless,  these  thermal  tests  demonstrate  that  it  is  possible  for  the  secondary  slide  of 
the  servo  valve  to  jam  to  the  valve  housing  and  leave  no  evidence  of  physical  marks. 
These  tests  also  demonstrate  that,  with  the  secondary  slide  thus  jammed,  it  is  possible  for 
the  primary  slide  to  overtravel  and  cause  a  rudder  hardover  in  the  direction  opposite  to  that 
commanded  without  leaving  any  physical  evidence. 

2.2.1  USAir  Flight  427  Computer  Simulation  Analysis 

Kinematic  analysis  and  workstation-based  computer  simulations  were  performed 
to  determine  the  control  wheel  (ailerons  and  flight  spoilers)  and  rudder  inputs  that  could 
produce  the  motion  of  the  airplane  between  the  time  of  the  initial  upset  and  ground  impact. 
During  its  investigation  of  this  accident,  the  Safety  Board  evaluated  many  solutions, 
including  the  kinematic  analysis  presented  by  Boeing  in  its  September  30,  1997, 
submission  to  the  Board.^'* 

Because  the  data  available  from  the  USAir  flight  427  FDR  was  limited  (in  both  the 
number  of  parameters  recorded  and  the  frequency  with  which  the  parameters  were 
recorded)^ and  investigators  could  not  positively  identify  the  characteristics  of  the  wake, 
multiple  control  wheel  and  rudder  solutions  provided  a  reasonable  match  with  the 
pertinent  FDR  data:  the  airplane’s  vertical  load  factor  (acceleration),  pitch,  roll,  and  (most 
importantly)  heading. 

The  Safety  Board  obtained  an  excellent  match  of  the  USAir  flight  427  FDR  data 
with  a  computer  simulation  in  which,  after  a  right  rudder  pedal  input  about  1903:00,  the 
rudder  reversed  as  a  result  of  a  jam  of  the  secondary  slide  to  the  servo  valve  housing 
(about  100  percent  off  neutral)  and  moved  to  its  left  blowdown  limit.  This  simulation 
(subsequently  referred  to  as  the  Safety  Board’s  best-match  simulation)  included  an 
estimation  of  the  influence  of  the  wake  vortex  during  the  upset  event  and  resulted  in  a 
heading  output  that  not  only  matched  the  FDR-recorded  heading  within  less  than  1°  but 
also  matched  the  character^'^  of  the  FDR-recorded  heading  data  until  about  1903:08,  at 


The  amount  of  hydraulic  fluid  flow  through  the  main  rudder  PCU  directly  affects  the  temperatures 
within  the  PCU  (increased  hydraulic  fluid  flow  through  the  PCU  results  in  increased  temperatures  within  the 
PCU  and  vice  versa).  Although  some  hydraulic  fluid  continually  flows  through  the  PCU  as  a  result  of 
leakage  around  the  primary  slide  permitted  by  the  underlapped  metering  edge  design,  additional  hydraulic 
fluid  flow  through  the  PCU  occurs  as  a  result  of  yaw  damper  activity  or  rudder  pedal  usage.  Therefore, 
normal  operations  in  smooth,  calm  air,  with  minimal  yaw  damper  activity  or  pilot  rudder  pedal  usage  would 
result  in  minimal  hydraulic  fluid  flow  through  the  PCU,  whereas  operations  in  turbulent  air  with  increased 
yaw  damper/rudder  activity  would  result  in  increased  hydraulic  fluid  flow  through  the  PCU.  Conditions 
were  quite  calm  before  the  USAir  flight  427  upset,  so  there  would  have  been  little  yaw  damper  activity  or 
rudder  usage  and  thus  very  little  hydraulic  fluid  flowing  through  and  warming  the  PCU.  However,  yaw 
damper  activity  upon  encountering  the  wake  vortex  would  have  resulted  in  increased  hydraulic  fluid  flow 
through  the  PCU. 

During  the  Safety  Board’s  first  technical  review  for  the  USAir  flight  427  accident,  which  was  held  on 
October  31,  1997,  in  Pittsburgh,  Boeing  presented  a  refined  version  of  the  information  contained  in  its 
September  30, 1997,  submission. 

For  more  information,  see  section  1.11.2. 
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which  time  the  stickshaker  activated  and  the  FDR  data  showed  the  beginning  of  an 
aerodynamic  stall. 

In  its  September  30,  1997,  submission  to  the  Safety  Board,  Boeing  presented  a 
kinematic  solution  for  the  USAir  flight  427  accident.  This  solution  postulated  that  the 
pilot  applied  full  left  rudder  about  1902:59,  relaxed  that  rudder  pressure  momentarily, 
applied  full  left  rudder  once  again  beginning  about  1903:01,  and  then  sustained  this  input 
until  ground  contact,  about  1903:23. 

A  comparison  of  the  heading,  roll,  and  vertical  acceleration  results  from  the  Safety 
Board’s  best-match  simulation  with  Boeing’s  kinematic  solution  indicates  that  both 
solutions  match  the  FDR  data  about  equally  well.  The  Safety  Board  then  evaluated  how 
well  the  rudder  and  control  wheel  time  histories  produced  by  the  Safety  Board  computer 
simulations  and  Boeing’s  kinematic  solution  comported  with  the  human  performance  data 
obtained  during  this  investigation. 

2.2.2  USAir  Flight  427  Human  Performance  Analysis 

A  review  of  CVR,  FDR,  and  ATC  information  indicated  that  the  accident  flight 
and  flight  crew  performance  were  routine  before  the  upset  occurred.  All  required 
checklists  were  completed,  communications  with  ATC  and  other  crewmembers  were 
appropriate,  and  the  pilots  were  responsive  and  displayed  no  evidence  of  problems  that 
would  impede  working  together  during  an  emergency.  No  evidence  indicated  any 
physiologic  or  ergonomic  reason  that  either  pilot  would  have  been  incapable  of 
manipulating  the  airplane’s  controls  throughout  their  range  of  motion  during  the  accident 
sequence.  Although  the  Safety  Board  was  unable  to  positively  determine  which  pilot  was 
manipulating  the  airplane’s  flight  controls  during  the  initial  upset  and  the  early  recovery 
attempts, the  following  indications  showed  that  the  first  officer  likely  provided  flight 
control  inputs  throughout  the  accident  sequence: 

•  The  first  officer  was  the  flying  pilot  for  the  flight  segment  during  which  the 
accident  occurred,  and  the  CVR  recorded  no  verbal  transfer  of  command  (as 
specified  in  USAir  procedures)  to  indicate  that  the  captain  had  assumed  those 
responsibilities. 

•  The  first  officer  emitted  straining  and  grunting  sounds  early  in  the  upset 
period,  which  speech  and  communication  experts  stated  were  consistent  with 
applying  substantial  physical  loads;  the  CVR  did  not  record  any  such  sounds 
on  the  captain’s  microphone  channel  until  just  before  ground  impact. 


The  “character  of  the  data”  is  used  in  this  report  to  refer  to  the  shape  of  the  curve  that  would  be 
formed  by  connecting  the  FDR  data  points  smoothly. 

The  Safety  Board  and  Boeing  were  unable  to  analyze  poststall/high  sideslip  events  because  the 
aerodynamic  model  of  the  airplane  in  that  condition  is  unreliable  and  inaccurate. 

Because  the  FDR  did  not  record  aileron  and  rudder  flight  control  inputs  at  either  pilot  position,  it  was 
not  possible  to  determine  what  flight  control  inputs  were  applied  by  the  flight  crew  or  which  pilot  applied 
such  controls.  The  FDR  recorded  control  column  position  but  did  not  identify  which  pilot(s)  applied  control 
column  pressure. 
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•  The  first  officer  keyed  the  microphone  (apparently  inadvertently)  on  the  air-to- 
ground  radio  channel  repeatedly  while  the  stickshaker  activated  between 
1903:09.4  and  the  end  of  the  recording,  which  would  be  consistent  with 
gripping  the  control  wheel  and  the  vibrations  of  the  stickshaker  tripping  his 
finger  on  and  off  the  radio  switch  on  the  back  of  the  yoke. 

The  captain  might  have  joined  the  first  officer  in  manipulating  the  flight  controls 
during  the  upset  sequence;  however,  according  to  speech  and  communication  experts,  the 
captain’s  breathing  (rapid  and  shallow)  and  speech  patterns  (for  example,  “whoa,”  “hang 
on,”  and  “what  the  hell  is  this”)  did  not  indicate  that  he  was  exerting  substantial  physical 
loads  during  the  initial  upset.  Further,  speech  experts  stated  that  the  captain’s  ‘  four  twenty 
seven  emergency”  transmission,  about  1903:15,  was  a  reasonable  attempt  to  communicate 
and  an  appropriate  response  for  the  situation,  but  the  captain’s  speech  during  the 
transmission  did  not  indicate  that  the  captain  was  exerting  substantial  physical  loads. 
After  about  1903:18  (about  5  seconds  before  ground  impact),  that  the  captain’s  breathing 
and  speech  patterns  recorded  by  the  CVR  indicated  that  he  might  have  been  exerting 
strong  force  on  the  controls  (as  he  said  “pull. ..pull.. .pull”).  Therefore,  the  Safety  Board 
concludes  that  analysis  of  the  human  performance  data  shows  that  it  is  likely  that  the  first 
officer  made  the  first  pilot  control  response  to  the  upset  event  and  manipulated  the  flight 
controls  during  the  early  stages  of  the  accident  sequence;  although  it  is  likely  that  both 
pilots  manipulated  the  flight  controls  later  in  the  accident  sequence,  it  is  unlikely  that  the 
pilots  simultaneously  manipulated  the  controls  (possibly  opposing  each  other)  during  the 
critical  period  in  which  the  airplane  yawed  and  rolled  to  the  left. 

As  previously  discussed,  the  accident  airplane  was  returning  to  level  flight  under 
autopilot  control  from  a  shallow  left  turn  to  an  ATC-assigned  heading  of  100°  when  it 
penetrated  the  wake  vortex  of  the  preceding  727  airplane  (Delta  flight  1083).  The  first 
officer  was  announcing  that  he  had  visual  contact  with  the  Jetstream  traffic  (Atlantic  Coast 
flight  6425),  of  which  ATC  had  advised  the  flight  crew,  when  the  accident  airplane’s  FDR 
began  to  record  vertical  loads  consistent  with  a  wake  vortex  encounter  from  the  727.  The 
most  severe  perturbations  resulting  from  the  wake  turbulence  penetration  occurred 
between  about  1902:55  and  about  1903:03.  As  the  airplane’s  bank  angle  (which  had  been 
rolling  out  of  a  commanded  left  bank  toward  a  wings-level  position)  began  accelerating  to 
the  left  away  from  level  flight,  the  turbulence  apparently  caused  the  captain  to 
inadvertently  activate  the  intercom  button  on  his  side  console^  and  caused  both  the 
captain  and  first  officer  to  voice  exclamations  of  surprise  (“sheeez”  and  “zuh”  at 
1902:57.5  and  1902:57.6,  respectively). 

The  results  of  the  Safety  Board’s  computer  simulation  and  Boeing’s  kinematics 
analysis  showed  a  significant  right  control  wheel  input  about  1902:58  in  response  to  the 
left  roll/yaw  effects  of  the  wake  vortex.  This  input  was  likely  the  result  of  the  first  officer 
reacting  to  the  wake  turbulence,  aggressively  inputting  right  control  wheel  (initially  about 
65°,  according  to  the  Safety  Board’s  simulation)  to  keep  the  airplane  level.^*’  The  speed 


The  captain  was  likely  touching  the  radio/intercom  transmit  button  on  his  side  console  because  he 
was  preparing  to  advise  ATC  that  he  and  the  first  officer  had  visual  contact  with  the  Jetstream  traffic. 
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of  this  pilot  reaction,  about  1  second  after  his  first  verbal  reaction,  suggested  a  reflexive 
action  to  counter  the  rolling  motions  of  the  wake.  The  timing  of  the  first  officer’s  early 
control  wheel  response  to  the  wake  turbulence  encounter  indicated  that  the  first  officer 
quickly  recognized  the  strength  of  the  wake-induced  roll  event  and  acted  accordingly.  The 
Safety  Board’s  simulation  (rudder  jam/reversal  scenario)  and  Boeing’s  simulation  (pilot 
input  scenario)  differ  markedly  as  to  what  happened  after  the  right  control  wheel  input. 

2.2.2.1  Rudder  Jam/Reversal  Scenario 

According  to  the  Safety  Board’s  computer  simulations,  at  about  1902:59,  as  the 
airplane  responded  to  the  right  control  wheel  input  and  began  rolling  back  toward  level 
flight,  the  control  wheel  position  moved  from  about  65°  right  to  about  15°  right.  This 
movement  indicates  that  the  first  officer  had  relaxed  his  input  force  on  the  control  wheel. 
However,  according  to  the  FDR,  between  about  1902:58  and  about  1903:00,  the  airplane’s 
heading  moved  quickly  past  the  assigned  100°  to  about  94°.  Both  the  Safety  Board’s 
computer  simulation  and  Boeing’s  kinematic  analysis  indicated  that  this  heading  change 
was  likely  to  have  been  associated  with  a  significant  yawing  motion^**  that  would  have 
caused  a  lateral  acceleration  at  the  pilots’  seats  of  more  than  0.1  G  to  the  left.  The  pilots 
would  have  likely  felt  this  acceleration  as  a  sustained,  uncomfortable  sideforce  in  the 
cockpit  and  would  have  observed  the  ground  and  sky  moving  sideways  against  the  fixed 
reference  of  the  airplane’s  windshield  area. 

Beginning  with  initial  flight  training  and  continuing  throughout  their  careers, 
pilots  are  trained  to  minimize  uncoordinated  yawing  motions  and  sideforces.  At 
1902:59.4,  the  captain  stated  “whoa”  likely  in  response  to  the  kinesthetic  and  visual 
sensations  produced  by  the  airplane’s  yawing  motion.^ It  would  have  been  reasonable 
for  the  first  officer  to  respond  to  this  yawing  motion  (and  possibly  to  the  captain’s 
statement)  by  applying  right  rudder  pedal  pressure  about  1903:00.  This  right  rudder  input, 
intended  to  relieve  the  sideforce  and  return  the  airplane  to  its  assigned  heading,  was 
instead  followed  by  a  rapid  rudder  deflection  to  the  left  (rudder  reversal)  that  increased  the 
left  yawing  motion  and  accelerated  the  airplane’s  heading  change  to  the  left. 

As  the  rudder  deflected  to  its  initial  blowdown  position,  the  rudder  pedals  would 
have  moved  in  a  direction  opposite  to  that  commanded  by  the  first  officer.  The  first 
officer  would  likely  have  sensed  the  right  rudder  pedal  rising  underneath  his  right  foot 
despite  attempts  to  depress  the  pedal.  During  that  time  (between  about  1903:00  and  about 


The  control  wheel  and  column  inputs  would  have  caused  the  autopilot  to  change  to  its  control  wheel 
steering  mode  for  both  the  pitch  and  roll  axes;  as  a  result,  the  first  officer’s  control  inputs  would  have 
positioned  the  flight  controls  through  the  autopilot  servos. 

According  to  the  geometry  of  USAir  flight  427’s  wake  vortex  encounter,  this  yawing  motion  likely 
resulted  from  the  entry  of  the  airplane’s  tail  into  the  vortex  field.  The  Safety  Board’s  computer  simulation  of 
the  event  models  the  wake  vortex  encounter  in  this  way. 

At  the  time  of  the  captain’s  statement,  the  left  yawing  motion  would  have  been  the  most  significant 
of  the  sensations  being  experienced  in  the  cockpit.  The  airplane’s  bank  angle  (19.5°  left)  and  pitch  angle 
(6.5°  nose  up)  were  within  the  parameters  of  normal  flight.  The  vertical  acceleration  was  relatively  small. 
Although  the  airplane  experienced  a  roll  acceleration  to  the  right,  it  remained  in  a  left  bank;  thus,  the  roll 
acceleration  would  have  been  in  the  direction  desired  by  the  pilots. 
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1903:02),  the  CVR  recorded  the  sounds  of  grunting  on  the  first  officer’s  hot  microphone 
channel.  Two  speech  experts  who  examined  these  sounds  indicated  that  they  were  signs 
of  significant  physical  effort,  greater  than  the  sounds  produced  by  the  normal  use  of  flight 
or  cockpit  controls.  One  speech  expert  concluded  that  the  sounds  indicated  that  the  first 
officer  was  “struggling  unusually  hard... for  example  [as]  if  he  was... experiencing  an 
unusual  resistance  in  the  use  of  a  control.”  The  Safety  Board  considers  it  likely  that  the 
soft  grunting  sound  recorded  on  the  CVR  at  1903:00.3,  shortly  after  the  start  of  the  rudder 
reversal,  is  a  manifestation  of  an  involuntary  physical  reaction  by  the  first  officer  to  the 
beginning  of  the  reversing  motion  of  the  rudder  pedal. 

Without  additional  input  pressure  from  the  first  officer,  the  right  pedal  would  have 
tended  to  push  his  foot  back  from  the  neutral  position.  However,  if  the  first  officer 
resisted  the  reversal,  the  right  rudder  pedal  would  have  yielded  somewhat.  Force  on  the 
right  rudder  pedal  could  have  returned  that  pedal  to  about  the  neutral  position.  However, 
as  the  airplane  entered  a  sideslip  (resulting  from  the  rudder  deflection),  the  maximum 
rudder  deflection  at  blowdown  would  have  increased;  thus,  the  rudder  pedal  would  have 
tended  to  push  the  pilot’s  foot  farther  aft. 

The  CVR  recorded  louder  grunting  sounds  by  the  first  officer  beginning  at 
1903:01.5,  about  0.6  seconds  after  the  rudder  pedals  would  have  reached  their  maximum 
uncommanded  displacement.  Few,  if  any,  actions  in  the  use  of  normally  functioning  737 
flight  controls  would  cause  a  pilot  to  strain  so  hard  as  to  grunt.^^”  The  first  officer  could 
not  have  been  grunting  because  of  control  column  (pitch)  inputs;  the  FDR  shows  that  the 
column  was  moving  freely  and  not  against  a  stop.  The  possibility  that  the  two  pilots 
struggled  against  each  other  by  making  opposing  inputs  is  unlikely  because  the  CVR  did 
not  record  any  straining  sounds  or  forced  breathing  from  the  captain  or  comments  from 
the  flight  crew  about  conflicting  inputs.  If  the  autopilot  is  engaged  in  the  control  wheel 
steering  (CWS)  mode,  a  pilot  might  grunt  while  attempting  aggressive  control  wheel 
inputs  that  exceeded  the  input  rate  of  the  autopilot.^^*  However,  no  grunting  sounds  were 
recorded  about  1902:58,  when  the  autopilot  would  have  been  in  CWS  mode  while  the  first 
officer  made  his  first  rapid  wheel  input  to  the  right.  Further,  both  the  Safety  Board 
computer  simulations  and  the  Boeing  kinematic  studies  showed  the  control  wheel  moving 
back  toward  neutral  during  the  latter  portion  of  the  time  that  the  grunting  sounds  were 
made  by  the  first  officer.  Movement  of  the  control  wheel  toward  neutral  would  be 
associated  with  relaxation  of  the  pilot’s  input  force  on  the  wheel  rather  than  the  addition  to 
or  maintenance  of  input  force  that  might  have  generated  the  grunting  sound. 


During  the  30  minutes  of  pilot  conversation  previously  recorded  by  the  CVR,  neither  pilot  had 
emitted  grunting  sounds  before  this  time. 

Information  provided  by  Boeing  indicated  that  the  forces  necessary  to  move  the  control  wheel  under 
the  CWS  mode  would  increase  quickly  from  about  15  to  about  40  pounds  or  more  as  a  pilot  exceeded  the 
input  rate  of  the  autopilot.  According  to  ergonomic  research,  such  control  wheel  forces  would  be  significant 
for  many  pilots  controlling  the  wheel  with  one  hand,  but  would  not  be  significant  for  pilots  controlling  the  ‘ 
wheel  with  two  hands.  See  McDaniel,  J.W.  1995.  “Strength  Capabilities  for  Operating  Aircraft  Controls.” 
SAFE  Journal  25  (1),  pages  28-34. 
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The  Safety  Board  was  unable  to  find  an  explanation  for  the  first  officer’s  louder 
grunting  sounds  other  than  his  efforts  to  overcome  a  rudder  system  malfunction  in  which 
he  was  increasing  the  pressure  on  the  rudder  pedal  with  no  apparent  effect.  Consequently, 
for  the  purposes  of  the  computer  simulation  of  the  rudder  jam/reversal  scenario,  the  first 
officer’s  reaction  to  the  rudder  reversal  was  modeled  as  the  application  of  increasing  force 
(400  pounds  of  force  within  1  second  of  the  beginning  of  the  reversal)  to  the  right  rudder 
pedal  to  oppose  the  direction  of  the  airplane’s  yaw  and  roll.^^^ 

From  a  human  performance  standpoint,  a  rudder  reversal  malfunction  can  explain 
how  a  full  rudder  deflection  could  have  continued  despite  efforts  by  the  first  officer  to 
correct  the  situation.  The  unexpected  rudder  pedal  reversal,  combined  with  the  rapid  left 
roll  and  yaw  of  the  airplane,  would  have  undoubtedly  confused  and  alarmed  the  first 
officer.  Any  pilot  pushing  on  the  rudder  pedal  in  this  situation  would  know  that  the  pedal 
was  not  responding  normally  but  would  have  difficulty  comprehending,  evaluating,  and 
correcting  the  situation.  A  reversal  malfunction  runs  counter  to  pilot  experience,  training, 
and  knowledge.  Depressing  a  rudder  pedal  during  a  reversal  malfunction  would  have  an 
effect  contrary  to  a  pilot’s  understanding  of  the  function  of  the  rudder  system.  Increased 
pressure  on  the  rudder  pedal  would  not  correct  the  problem.^^^  As  long  as  the  airplane 
continues  to  depart  from  controlled  flight,  a  pilot  reacting  to  a  rudder  reversal  would  likely 
maintain  at  least  some  pedal  pressure  in  a  continued  attempt  to  oppose  the  uncommanded 
yawing  and  rolling  moments. 

During  the  few  seconds  after  the  left  rudder  deflection  that  occurred  about 
1903:00,  the  accident  airplane’s  control  wheel  position  was  adjusted  several  times, 
eventually  reaching  nearly  full  right  control  wheel,  in  response  to  the  airplane’s  left  rolling 
and  yawing  motions.  Any  pilot  faced  with  an  acceleration  away  from  the  desired 
flightpath  could  be  expected  to  make  an  initial  control  input  (about  65°  right  control  wheel 
in  this  case)  to  assess  the  effects  of  the  control  input;  remove  some,  or  all,  of  the  input 
when  the  airplane  began  to  respond  (so  as  not  to  overcontrol);  and  converge  on  the 
appropriate  input  (almost  full  right  wheel  in  this  case).  Thus,  the  Safety  Board  considered 
that  the  flight  crew’s  control  wheel  inputs  in  response  to  the  initial  wake  turbulence 
encounter  and  rudder  reversal  were  reasonable  pilot  reactions  to  the  evolving  situation. 
Therefore,  the  flight  control  inputs  used  in  the  Safety  Board’s  best-match  computer 
simulation  of  the  USAir  flight  427  upset  are  consistent  with  the  pilot  responses  that  might 
be  expected  during  a  rudder  reversal.  Further,  the  CVR  information  from  the  period  of  the 
initial  upset  is  consistent  with  rudder  reversal. 


Although  the  Safety  Board’s  best-match  simulation  used  400  pounds  of  force  reducing  to  200 
pounds,  based  on  ergonomic  and  other  research  data  (as  discussed  in  section  1.18.8),  the  Safety  Board  was 
also  able  to  obtain  an  excellent  match  using  only  the  minimum  pedal  force  necessary  to  sustain  full  rudder 
authority  (about  70  pounds). 

As  previously  indicated,  the  Safety  Board  has  investigated  aviation  accidents  that  have  been  caused 
by  flight  control  reversals  (see  section  1.16.5.4.8).  The  Board  notes  that  such  reversals  are  often  fatal 
because  few  pilots  (even  test  pilots)  are  able  to  absorb  the  information,  analyze  it,  and  apply  inputs  to  correct 
the  situation  in  the  moments  available  before  the  airplane  attains  an  unrecoverable  attitude. 
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The  grunting  sounds  ended  at  1903:02.1,  when  the  CVR  also  recorded  the  sound 
of  the  autopilot  disengaging.  According  to  the  Safety  Board’s  computer  simulation,  the 
wheel  was  briefly  returned  to  near  neutral  at  that  time.  The  CVR  did  not  record  any  more 
grunting  or  straining  sounds  until  a  few  seconds  before  ground  impact.  This  evidence  is 
consistent  with  the  first  officer  slightly  relaxing  his  control  wheel  and  rudder  pedal 
inputs — perhaps  because  he  thought  that  he  was  contending  with  a  malfunctioning 
autopilot,  in  which  case  autopilot  disengagement  would  restore  normal  control. 

After  disengaging  the  autopilot,  the  first  officer  likely  focused  his  attention  on 
modulating  the  control  wheel  inputs  or  attempting  to  raise  the  airplane’s  nose  and,  in  the 
quickly  changing  situation,  did  not  return  his  attention  to  overpowering  the  rudder  pedal 
anomaly.  On  the  basis  of  the  cessation  of  grunting  sounds  and  the  control  wheel  inputs 
that  followed,  the  Safety  Board’s  computer  simulation  of  the  rudder  jam/reversal  scenario 
incorporated  a  reduction  in  the  pilot’s  right  rudder  pedal  pressure  to  200  pounds  at  that 
time.  Because  the  rudder  feel  and  centering  unit  would  combine  with  the  pilot’s  foot 
pressure  in  applying  force  to  the  PCU  during  a  rudder  reversal,  the  rudder  reversal  could 
have  continued  with  a  minimum  rudder  pedal  pressure  by  the  pilot  of  only  about  50 
pounds. 

2.2.2.2  Pilot  Input  Scenario 

According  to  the  Boeing  kinematic  solution,  the  pilots  of  USAir  flight  427  applied 
full  right  control  wheel  about  1902:58  in  response  to  the  left  roll  and  yaw  from  the 
airplane’s  encounter  with  the  wake  vortex.  Boeing  proposed  that  the  pilots  then  applied 
left  rudder  input  from  about  1902:58  to  about  1903:01  in  response  to  a  right  roll 
acceleration  (shown  in  Boeing’s  kinematic  analysis  from  about  1902:58  to  about  1902:59) 
from  the  control  wheel  input,  which  momentarily  reversed  the  airplane’s  left  rolling 
motion.  However,  such  a  right  roll  acceleration  would  have  helped  the  pilots  stop  the  left 
roll  and  regain  a  level  bank  attitude;  thus  there  would  be  little  reason  for  the  pilots  to  have 
opposed  the  right  roll  acceleration.  (In  fact,  Boeing’s  scenario  indicated  that,  at  the  time 
of  the  proposed  full  left  rudder  pedal  input,  the  right  control  wheel  input  had  just  stopped 
the  airplane’s  left  roll.)  Although  the  right  roll  acceleration  toward  level  flight  might  have 
prompted  the  flight  crew  to  remove  some,  or  all,  of  the  existing  right  control  wheel  input, 
it  is  unlikely  that  the  flight  crew  would  have  responded  to  this  right  roll  acceleration  by 
applying  full  left  rudder  before  using  the  airplane’s  roll  control  authority  to  the  left. 

Moreover,  both  the  Safety  Board’s  computer  simulation  and  Boeing’s  kinematic 
analysis  of  this  period  indicated  that  the  pilots  were  experiencing  the  sideload  from  a  yaw 
acceleration  to  the  left  (caused  by  the  wake  vortex).  The  sideload  would  logically  have 
prompted  the  pilots  to  apply  right,  rather  than  left,  rudder.  Therefore,  the  Safety  Board 
considers  it  highly  unlikely  that  the  flight  crew  of  USAir  flight  427  applied  full  left  rudder, 
as  specified  in  the  pilot  input  scenario  proposed  by  Boeing. 

Further,  Boeing’s  pilot  input  scenario  requires  the  flight  crew  to  have  sustained  the 
full  left  rudder  input  for  at  least  10  seconds.  In  its  September  30,  1997,  submission  and 
Human  Factors  Supplement  Submission,  Boeing  cited  four  737  incidents  (in  October 
1986,  April  1993,  July  1995,  and  June  1997)  in  which  the  FDR  data  indicated  that  flight 
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crew  responses  to  unexpected  upsets  resulted  in  momentary  cross-control  situations. 
However,  FDR  information  also  showed  that  the  flight  crews  maintained  control  of  the 
airplane.  The  airplanes’  flight  attitudes  never  exceeded  reasonable  levels,  and  the 
airplanes  never  diverged  from  controlled  flight.  The  control  inputs,  bank  angles,  and 
headings  all  converged  on  stable  values,  and  all  of  the  flights  landed  safely. 

During  the  USAir  flight  427  upset,  the  airplane’s  increasingly  extreme  left  bank 
attitude  would  have  provided  the  pilots  with  a  consistent  and  powerful  cue  to  remove  any 
left  control  inputs  they  may  have  applied.  Further,  the  Safety  Board’s  review  of  available 
data  from  previous  accidents  and  incidents  obtained  from  Boeing,  the  Board’s  database, 
and  accident  investigation  authorities  worldwide  indicated  that  momentary,  incorrect 
rudder  applications  by  air  carrier  pilots  have  occasionally  occurred  in  response  to  an 
unexpected  anomaly  during  a  critical  phase  of  flight.  However,  those  events  often 
occurred  in  conditions  of  reduced  external  visual  cues  or  during  abrupt,  rapid  aircraft 
movements  and  accelerations.  Some  pilots  reported  being  startled  by  the  in-flight  upset, 
but  no  case  was  found  in  which  a  pilot  responded  to  an  in-flight  upset  involving  a 
sustained  yaw  or  roll  by  continuing  to  hold  extreme  rudder  input  in  a  direction  opposite  to 
that  required  to  recover  the  airplane. 

To  further  evaluate  the  possibility  of  a  sustained,  inappropriate  rudder  input,  the 
Safety  Board  examined  numerous  possible  explanations  for  the  flight  crew  to  have  applied 
and  sustained  a  full  left  rudder  input  until  a  loss  of  control  occurred.  These  possibilities 
included  pilot  incapacitation,  deliberate  pilot  action,  disorientation,  and  unintended  rudder 
pedal  activation. 

The  Safety  Board  reviewed  documentation  from  two  incidents  in  which  pilot 
(specifically,  first  officer)  incapacitation  adversely  affected  the  controllability  of  a  737.  In 
both  cases,  the  incapacitation  occurred  suddenly;  the  first  officers  stiffened  and  applied 
pressure  to  a  rudder  pedal,  resulting  in  a  large  rudder  deflection  as  the  airplanes  descended 
during  the  approach  to  their  destination  airports.  Although  both  captains  reported  that 
they  were  startled  by  the  unexpected  event,  both  responded  appropriately  and  were 
capable  of  compensating  for  inputs  made  by  the  incapacitated  first  officers.  Neither  of 
these  cases  resulted  in  a  significant  loss  of  control.  Further,  a  review  of  the  available  data 
from  previous  accidents  and  incidents  revealed  no  evidence  of  pilot  incapacitation  that 
had  resulted  in  a  loss  of  control  in  other  air  carrier  airplanes.  In  the  case  of  USAir  flight 
427,  no  evidence  indicated  that  pilot  incapacitation  was  involved  in  the  accident  sequence 
because 

•  neither  pilot  had  a  medical  history  that  indicated  a  risk  of  incapacitation, 

•  CVR  evidence  indicated  that  both  pilots  were  alert  and  appropriately 
responsive  during  the  accident  sequence,  and 

•  CVR  evidence  indicated  that  neither  pilot  was  alarmed  by  the  behavior  of  the 
pilot  or  that  any  medical  emergency  was  occurring. 

The  Safety  Board  considered  whether  either  pilot  deliberately  applied  an  incorrect 
rudder  input.  However,  the  remarks  and  sounds  recorded  by  the  CVR  during  the  initial 
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upset  and  loss  of  control  indicated  that  both  pilots  were  surprised  by  the  event  and  did  not 
understand  its  nature  or  cause.  Further,  the  Safety  Board  carefully  examined  aspects  of 
the  pilots’  personal  and  professional  lives  and  found  both  pilots  to  be  stable.  Moreover, 
analysis  of  the  communications  and  sounds  recorded  by  the  CVR  indicated  that  the  pilots 
expended  extraordinary  effort  in  their  attempts  to  recover  from  the  upset  throughout  the 
accident  sequence.  Therefore,  no  evidence  supports  a  deliberate  action  by  either  pilot  to 
apply  the  rudder  incorrectly. 

The  Safety  Board  also  considered  the  possibility  that  one  or  both  of  the  pilots 
became  disoriented  during  the  loss  of  control  and  was  therefore  unable  to  take  actions  to 
recover  control  of  the  airplane.  The  accident  and  incident  records,  expert  opinions,  and 
literature  regarding  spatial  disorientation  (a  phenomenon  that  occurs  when  visual  and 
kinesthetic/vestibular  cues  are  in  conflict)  indicate  that  spatial  disorientation  resulting  in  a 
loss  of  airplane  control  is  extremely  improbable  in  air  carrier  operations  when  strong 
external  visual  cues  exist,  even  if  abrupt,  rapid  airplane  movements  and  accelerations 
occur. 


Witnesses  on  the  ground  and  the  pilots  of  other  airplanes  in  the  area  reported  that 
the  sky  was  clear  with  a  visible  horizon  when  the  USAir  flight  427  accident  occurred.  The 
accident  airplane  was  operating  in  a  cruise  flight  attitude,  and  the  pilots  would  have  had  no 
obstructions  to  visual  cues.  The  horizon  would  have  been  visible  to  both  pilots  when, 
according  to  Boeing’s  proposed  scenario,  the  first  officer  made  and  held  a  left  rudder 
input.  Thus,  the  pilots  of  USAir  flight  427  had  ample  visual  cues  available  to  maintain  an 
accurate  awareness  of  the  airplane’s  orientation. 

To  illustrate  a  vehicle  operator’s  persistence  in  making  an  inappropriate  control 
input,  Boeing’s  September  30,  1997,  Human  Factors  Supplement  Submission  suggested 
the  phenomenon  of  “unintended  acceleration’’  from  automotive  safety  literature.^^"*  This 
phenomenon  refers  to  evidence  from  automobile  accidents  that  drivers  may  inadvertently 
press  the  accelerator  pedal  when  they  believe  that  they  are  applying  the  brake  pedal,  which 
can  lead  to  the  driver  pressing  even  harder  on  the  accelerator  pedal  in  the  belief  that  this 
action  will  slow  the  motion  of  the  automobile.  However,  unlike  automobile  drivers,  pilots 
use  a  different  foot  to  activate  each  rudder  pedal.  Further,  the  737  cockpit  layout  locates 
the  stem  of  the  control  column  and  a  large  rudder  pedal  adjustment  mechanism  between 
each  pilot’s  legs,  making  it  physically  difficult  or  impossible  to  push  a  rudder  pedal  with 
the  wrong  leg.  Therefore,  the  possibility  that  a  pilot  would  activate  the  wrong  rudder 
pedal  on  a  737  is  much  less  than  the  possibility  that  an  automobile  driver  would  confuse 
the  accelerator  and  brake  pedals. 

In  addition,  an  important  factor  in  an  automobile  driver’s  persistence  in  pressing 
down  the  accelerator  pedal  in  such  events  is  the  driver’s  perception  that  the  brake  is  being 
applied;  hence,  the  driver  believes  that  the  more  pedal  pressure  applied,  the  better  chance 


Schmidt,  R.  A.  1989.  “Unintended  acceleration:  A  review  of  human  factors  contributions.”  Human 
Factors,  31,  pp.  345-64.  Also,  Reinhart,  W.  “The  effect  of  countermeasures  to  reduce  the  incidence  of 
unintended  acceleration  accidents.”  Proceedings  From  the  Fourteenth  International  Technical  Conference 
on  Enhanced  Safety  of  Vehicles,  Munich,  Germany,  1994. 
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there  is  for  recovery.  In  this  respect,  the  phenomenon  of  unintended  acceleration  in 
automobiles  may  be  more  instructive  with  regard  to  pilot  actions  and  frame  of  mind  in  a 
rudder  reversal  scenario  than  in  a  pilot  input  scenario. 

The  Safety  Board  analyzed  the  CVR  for  possible  indications  of  a  left  rudder  input 
by  the  pilots.  The  grunting  sounds  recorded  on  the  first  officer’s  hot  microphone  channel 
were  not  well  correlated  in  time  with  any  of  the  pilot  control  actions  proposed  by  Boeing’s 
scenario  that  might  have  resulted  in  such  sounds.  According  to  Boeing,  the  grunting 
sounds  occurred  after  the  first  officer  made  a  full  right  control  wheel  input  and  the  first  of 
two  postulated  left  rudder  inputs.  However,  neither  of  the  two  postulated  rudder  inputs 
would  have  required  more  than  70  pounds  of  force  on  a  normally  operating  left  rudder 
pedal.  This  relatively  mild  force  should  not  cause  a  pilot  to  grunt.  Although  a  pilot  could 
exert  more  than  70  pounds  of  force  in  holding  a  rudder  at  full  deflection,  there  would  be 
no  reason  to  do  so  once  full  left  rudder  deflection  was  achieved. 

Also,  it  is  unreasonable  that  both  pilots  would  have  allowed  a  sustained  incorrect 
rudder  input  to  continue  in  the  presence  of  salient  cues  without  one  of  them  recognizing 
the  error  and  commenting  and/or  attempting  to  correct  the  rudder’s  position.  The  CVR 
did  not  record  any  evidence  of  one  pilot  being  alarmed  or  struggling  against  the  control 
inputs  of  the  other  pilot  (as  might  be  expected  if  a  pilot  made  an  abrupt  and 
counterproductive  flight  control  input).  Rather,  the  CVR  recorded  sounds  indicating  that 
both  pilots  were  surprised  by  and  did  not  understand  the  event  as  it  developed  from  a  wake 
turbulence  encounter  into  a  more  critical  situation. 

2.2.2.3  USAir  Flight  427  Scenario  Summary 

No  evidence  indicates  that  an  air  carrier  pilot  has  ever  responded  to  an  in-flight 
upset  by  applying  and  holding  full  rudder  in  the  incorrect  direction  to  the  extent  that 
control  was  lost.  Also,  the  circumstances  of  this  accident  are  inconsistent  with  the  pilots 
applying  and  sustaining  a  left  rudder  input  because  of  pilot  incapacitation,  deliberate  pilot 
action,  unintended  rudder  pedal  activation,  or  spatial  disorientation.  Further,  CVR 
information  does  not  support  pilot  left  rudder  pedal  input  as  the  explanation  for  the  left 
rudder  deflection  in  this  accident.^^^  Consequently,  the  Safety  Board  concludes  that 
analysis  of  the  human  performance  data  (including  operational  factors),  does  not  support  a 
scenario  in  which  the  flight  crew  of  USAir  flight  427  applied  and  held  a  full  left  rudder 
input  until  ground  impact  more  than  20  seconds  later.  The  Safety  Board  further  concludes 
that  analysis  of  the  CVR,  Safety  Board  computer  simulation,  and  human  performance  data 
(including  operational  factors)  from  the  USAir  flight  427  accident  shows  that  they  are 
consistent  with  a  rudder  reversal  most  likely  caused  by  a  jam  of  the  main  rudder  PCU 
servo  valve  secondary  slide  to  the  servo  valve  housing  offset  from  its  neutral  position  and 
overtravel  of  the  primary  slide. 


Although  the  rudder  pedal  pivot  lugs  on  both  the  captain’s  and  first  officer’s  rudder  pedal  assemblies 
were  damaged,  (see  section  1.16.5.1),  this  damage  provided  no  useful  evidence  of  pilot  rudder  pedal 
activation  during  the  upset. 
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2.2.2A  Likelihood  of  Recovery  From  a  Rudder  Reversai 

FDR  data  and  Safety  Board  computer  simulations  indicated  that,  about  1902:59, 
the  airplane  began  to  roll  to  the  left  and  pitch  slightly  nose  down,  and  the  control  column 
position  began  to  move  slightly  aft.  Although  the  airplane’s  left  bank  continued  to 
increase  by  about  1903:02,  the  nose-down  pitch  rate  had  been  temporarily  arrested  by  the 
aft  control  column  inputs.  The  airplane’s  motions  and  the  aft  control  column  pressure 
resulted  in  a  slight  increase  in  vertical  load  (to  about  1.2  Gs).  On  the  basis  of  the  existing 
airspeed  and  the  increase  in  vertical  G  load,  by  about  1903:02  the  airplane  would  have 
been  below  the  airspeed  at  which  the  roll  controls  (aileron  and  spoilers)  could  counter  the 
effects  of  the  fully  deflected  rudder  (crossover  airspeed).  Thus,  from  that  time  onward,  it 
would  have  been  impossible  for  the  flight  crew  to  regain  roll  control  without  increasing 
airspeed  and/or  decreasing  the  airplane’s  vertical  G  load. 

After  the  autopilot  was  disengaged  about  1903:02,  the  airplane’s  left  bank  angle 
continued  to  increase  and  the  control  column  position  continued  to  move  farther  aft.  As  a 
result,  by  about  1903:03,  the  vertical  load  had  increased  to  about  1.55  Gs.  At  that  time,  aft 
control  column  input  would  have  been  an  instinctive  pilot  reaction  to  try  to  prevent  the 
airplane  from  pitching  nose  down  in  a  steep  bank  and  maintain  the  ATC-assigned  (and 
pilot-selected)  altitude. 

During  the  early  seconds  of  the  upset  event,  the  pilots  did  not  likely  suspect  that 
the  event  was  anything  other  than  a  strong,  but  otherwise  routine,  wake  turbulence 
encounter.  They  had  no  foreknowledge  of  a  rudder  reversal  or  rudder  hardover  or  of  the 
crossover  airspeed  phenomenon.  Therefore,  it  is  understandable  that  the  pilots  of  USAir 
flight  427  would  have,  at  least  momentarily,  attempted  to  maintain  their  assigned  altitude 
by  increasing  control  column  back  pressure.  Further,  it  is  extremely  unlikely  that  the 
pilots  would  have  been  able  to  diagnose  the  relationship  between  airspeed,  vertical  G  load, 
and  the  loss  of  control  in  the  few  seconds  available  to  them  after  this  back  pressure 
brought  the  airplane  below  the  crossover  airspeed. 

The  accident  airplane’s  FDR  data  indicated  that  the  control  column  position 
generally  continued  to  move  farther  aft  as  the  event  continued;  the  airplane  continued  to 
roll  left  and  pitch  farther  nose  down,  decelerated  a  few  knots,  and  began  to  lose  altitude. 
About  1903:08,  as  the  airplane  descended  through  about  5,700  feet  msl,  the  stall  warning 
stickshaker  activated,  indicating  to  the  pilots  that  the  aft  column  input  was  commanding 
an  angle-of-attack  near  stall.  However,  by  that  time  the  airplane  had  attained  an  extreme 
attitude  (about  70°  left  bank  and  more  than  20°  nose  down),  which  would  have  been  well 
beyond  any  attitude  that  the  pilots  would  have  experienced  in  air  carrier  operations. 
About  3  seconds  later,  when  the  control  column  reached  its  full  aft  position,  the  airplane’s 
bank  angle  had  gone  beyond  vertical  (90°),  and  its  pitch  attitude  had  exceeded  50°  below 
the  horizon. 


Boeing  pilots  who  were  evaluating  the  737 ’s  handling  characteristics  during  postaccident  flight  tests 
identified  a  stronger-than-expected  relationship  between  vertical  G  load  and  the  ability  to  overpower  the  roll 
induced  by  a  full  rudder  deflection  with  full  wheel  input.  The  pilots  reported  that  “there  is  some  technique 
[required]  between  the  G  and  the  roll.” 
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The  Safety  Board  notes  that  pilots  are  trained  to  respond  to  the  stickshaker 
warning  by  decreasing  pitch  (column  forward).  In  some  previous  air  carrier  accidents 
involving  stalls,  the  Board  has  cited  the  flight  crew  as  a  causal  factor  in  the  accident  for 
failing  to  take  the  necessary  actions  to  recover  from  the  stall.^^’  However,  in  a  rudder 
reversal  scenario,  the  pilots  of  USAir  flight  427  would  have  been  struggling  to  cope  with 
the  rudder’s  anomalous  movements  (in  addition  to  the  airplane’s  extreme  roll  and  pitch 
attitudes)  when  they  also  would  have  been  surprised  to  discover  that  full  left  control  wheel 
input  was  ineffective  in  countering  the  airplane’s  steepening  left  roll.  These  factors 
combined  to  produce  a  flight  situation  and  control  problems  that  the  pilots  of  USAir  flight 
427  had  never  before  encountered  in  flight  or  training,  including  during  stickshaker/stall 
recovery  training.  With  this  series  of  problems  in  the  course  of  a  few  seconds,  it  is 
understandable  that  the  crew  was  no  longer  responding  in  a  manner  that  might  have 
allowed  recovery.^^* 

During  postaccident  simulator  tests,^^^  test  subjects  were  able  to  recover  from  the 
USAir  flight  427  upset,  or  at  least  stabilize  the  roll  to  the  point  at  which  a  continued  loss 
of  control  would  most  likely  not  have  occurred,  when  they  applied  a  specific  recovery 
technique  (full  right  control  wheel  maintained  throughout  the  duration  of  the  event  and 
forward  control  column  pressure  sufficient  to  reduce  G  load  and  maintain  a  speed  above 
the  crossover  airspeed)  promptly  when  the  event  began.  However,  unlike  the  pilots  of 
USAir  flight  427,  the  simulator  test  subjects  were  aware  of  the  circumstances  of  the 
accident,  prepared  for  and  expecting  the  upset  event  as  it  occurred,  and  coached  through 
the  recovery  procedure. 

When  the  simulator  test  subjects  varied  their  responses  from  the  specific 
techniques  that  they  were  told  to  apply  (for  example,  when  they  modified  their  control 
wheel  input  in  anticipation  of  the  simulator’s  responses  to  their  inputs),  a  successful 
recovery  from  the  upset  event  became  much  less  likely.  Further,  when  the  simulator  test 
subjects  tried  to  maintain  altitude  at  the  outset  of  the  event,  the  simulator’s  speed 
decreased  below  the  crossover  airspeed,  and  recovery  became  unlikely. 

Therefore,  although  it  was  possible  to  recover  from  the  upset  event  during  its  early 
stages,  such  a  recovery  would  have  required  the  pilots  to  immediately  abandon  their 
normal  pitch  control  criterion  (maintaining  altitude)  and  hold  full  control  wheel  inputs 
against  the  roll.  These  actions  may  be  successful  with  prior  awareness  of  the  effects  of  a 


See,  for  example.  National  Transportation  Safety  Board.  1997.  Uncontrolled  Flight  Into  Terrain, 
ABX  Air  Inc.  (Airborne  Express),  Douglas  DC-8-63,  N827AX,  Narrows,  Virginia,  December  22,  1996. 
Aircraft  Accident  Report  NTSB/AAR-97/05.  Washington,  DC. 

No  reliable  aerodynamic  model  exists  for  the  737’s  flight  characteristics  in  a  stall;  consequently,  the 
Safety  Board  could  not  evaluate  the  possibility  of  recovery  after  activation  of  the  stickshaker.  The  Safety 
Board  notes,  however,  that  if  the  pilots  had  reacted  to  the  stickshaker  by  reducing  aft  control  column 
pressure  only  enough  to  silence  the  stickshaker  (as  air  carrier  pilots  are  trained  to  do  in  a  minimum  altitude 
loss  stall  recovery),  the  airplane  would  have  remained  below  the  crossover  airspeed  for  the  existing  vertical 
G  load,  and  the  pilots  would  not  have  regained  control  of  the  airplane. 

These  simulator  tests  were  conducted  in  Boeing’s  M-CAB  simulator  using  the  accident  airplane’s 
FDR  data  and  a  rudder  hardover  (induced  either  manually  or  electronically)  to  represent  the  USAir 
flight  427  upset  condition. 
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rudder  reversal  and  the  crossover  airspeed,  as  shown  by  the  simulator  tests.  The  Safety 
Board  concludes  that  the  flight  crew  of  USAir  flight  427  recognized  the  initial  upset  in  a 
timely  manner  and  took  immediate  action  to  attempt  a  recovery  but  did  not  successfully 
regain  control  of  the  airplane.  However,  because  the  pilots  did  not  have  foreknowledge  of 
the  problem,  immediate  awareness  of  its  onset,  and  prior  training  and  experience  with  the 
crossover  airspeed  phenomenon,  the  Safety  Board  concludes  that  the  flight  crew  of  USAir 
flight  427  could  not  be  expected  to  have  assessed  the  flight  control  problem  and  then 
devised  and  executed  the  appropriate  recovery  procedure  for  a  rudder  reversal  under  the 
circumstances  of  the  flight. 

2.3  United  Flight  585  Upset 

2.3.1  United  Flight  585  Computer  Simulation  Analysis 

and  radar  data,  the  accident  location,  and  wreckage  orientation  were  used 
as  data  points  in  the  Safety  Board’s  computer  simulation  studies  of  United  flight  585. 
Because  the  FDR  did  not  record  roll  or  sideload  information,  it  was  not  possible  to 
positively  determine  whether  the  recorded  heading  changes  were  the  result  of  a  roll  or  a 
sideslip  followed  by  a  roll.^^'  Other  variables  had  to  be  factored  into  the  simulation 
studies.  The  winds  and  turbulence  encountered  by  United  flight  585  during  the  approach 
undoubtedly  acted  on  the  airplane  during  the  upset  and  descent.  Because  the  exact  winds 
encountered  by  the  airplane  were  not  known,  the  winds  could  be  reasonably  varied  during 
the  simulations,  resulting  in  a  number  of  possible  scenarios  that  would  be  consistent  with 
the  radar  data  and  the  limited  FDR  data.  Pilot  pedal  input  force  was  another  variable  that 
was  incorporated  in  the  simulations. 

The  Safety  Board  employed  several  computer  simulation  scenarios  in  which  the 
resulting  heading  data  matched  the  available  FDR  data.  These  simulations  used  rudder 
position  time  histories  that  assumed  jams  of  the  secondary  slide  to  the  valve  housing  at 
various  positions  from  the  neutral  position  (100,  71,  50,  40,  and  30  percent),  and  a 
concomitant  rudder  reversal.  (Each  of  the  rudder-related  solutions  required  a  control 
wheel  response  opposing  the  roll). 

The  Safety  Board’s  best-match  computer  simulation  was  one  in  which  the 
secondary  slide  jammed  at  100  percent  off  its  neutral  position  and,  about  0943:32,^^^  the 
rudder  reversed  in  response  to  the  pilot’s  attempt  to  make  a  left  rudder  input.  In  this 
simulation,  the  airplane’s  right  yaw  rate  had  reached  4.7°  per  second  just  before  the  rudder 
reversal  because  of  the  effects  of  a  wind  gust  (a  17-knot  decrease  in  the  wind  velocity  for 
3  seconds  as  the  airplane  descended  on  its  approach).  The  Safety  Board  incorporated  this 


United  flight  585  was  equipped  with  a  five-parameter  FDR,  which  recorded  microphone  keying, 
airspeed,  altitude,  and  heading  at  once-per-second  intervals  and  vertical  Gs  at  8  times  per  second. 

Simulations  using  a  control  wheel  input  could  produce  a  scenario  involving  only  a  roll,  whereas 
simulations  using  a  rudder  movement  could  produce  a  scenario  involving  a  sideslip  followed  by  a  roll,  both 
of  which  could  be  consistent  with  the  recorded  data. 

All  times  in  this  section  and  section  2.3.2  are  mountain  standard  time,  based  on  a  24-hour  clock. 
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wind  velocity  change  with  decreased  altitude  into  its  computer  simulation  to  match  the 
heading  data  recorded  by  the  FDR  from  about  0943:28  to  about  0943:31.  The  heading 
output  from  the  Safety  Board’s  best-match  simulation  matched  the  FDR  heading  data 
within  1°  or  less  and  matched  the  character  of  the  data. 

The  Safety  Board’s  computer  simulations  that  used  right  control  wheel  input  alone 
(and  no  rudder  movement)  also  produced  heading  results  that  matched  the  available  FDR 
data.  However,  that  solution  was  not  considered  to  be  realistic  because  it  required  the 
pilots  to  fly  the  airplane  into  the  ground  when  simple  wheel  corrections  could  prevent  this 
occurrence.  The  Safety  Board  has  no  evidence  that  the  pilots  of  United  flight  585  would 
have  deliberately  flown  the  airplane  into  the  ground.^^^ 

The  Safety  Board  could  also  match  the  FDR  data  by  assuming  that  the  increasing 
roll  was  the  result  of  a  rotational  external  wind,  such  as  a  mountain  rotor.  The  Safety 
Board  considered  the  possibility  that  a  mountain  rotor  forced  the  airplane  along  the 
accident  flightpath.^^'^  With  the  weather  conditions  present  in  the  area  on  the  day  of  the 
accident  (strong  westerly  winds  flowing  over  the  mountains  located  west  of  the  accident 
site),  rotors  could  have  been  generated,  rotating  in  a  clockwise  direction  (from  United 
flight  585’s  perspective  on  the  approach).  These  rotors  would  have  likely  been  moving  to 
the  east  (pilots’  left  to  right)  with  the  wind  at  an  unknown  altitude;  however,  it  is  possible 
for  a  mountain  wave  to  trap  a  rotor,  resulting  in  a  “standing”  rotor,  which  would  not  move 
with  the  wind. 

In  a  June  23,  1997,  letter  to  the  Safety  Board,  Boeing  indicated  that  a  “rudder 
hardover  scenario”  did  not  fit  the  United  flight  585  FDR  data  but  that  a  “new  rotor  model” 
it  developed  did  fit  the  data.  This  Boeing  model  proposed  an  encounter  with  a  rotor  that 
followed  the  flightpath  of  the  accident  airplane  and  increased  in  strength  to  about  1.8 
radians  (103°)  per  second  as  the  airplane  descended  to  the  ground.  However,  according  to 
NOAA  scientists,  the  strongest  rotors  ever  documented  in  the  Colorado  Springs  area  had  a 
strength  of  about  0.05  radians  per  second.  Further,  a  NOAA/National  Center  for 
Atmospheric  Research  (NCAR)  report^^^  indicated  that  researchers  have  not  documented 
rotors  that  would  descend  to  the  ground  in  increasing  strength,  such  as  the  one  proposed 
by  Boeing. 

The  Safety  Board  evaluated  the  accident  airplane’s  FDR  information  for  signatures 
that  would  be  expected  if  the  airplane  encountered  a  rotor.  In  addition  to  changes  in 


Reports  from  other  pilots  who  had  flown  with  the  captain  (the  flying  pilot  on  United  flight  585 
indicate  that  he  was  a  very  conservative  and  conscientious  pilot.  These  reports  are  consistent  with  the 
captain’s  conduct  on  the  accident  flight,  as  documented  on  the  CVR. 

The  Safety  Board  considered  several  mountain  rotor  scenarios,  including  moving  rotors  above, 
below  and  at  the  airplane’s  altitude;  standing  rotors  located  left,  right,  and  directly  along  the  airplane’s 
flightpath;  and  horizontal  rotors  that  transition  to  vertical  rotors  along  the  airplane’s  flightpath. 

The  NOAA/NCAR  interim  report  (prepared  in  response  to  Safety  Recommendation  A-92-57)  was 
entitled  A  Pilot  Experiment  to  Define  Mountain-Induced  Aeronautical  Hazards  in  the  Colorado  Springs 
Area:  Project  MCAT97  (Mountain-Induced  Clear  Air  Turbulence  1997).  The  NOAA/NCAR  final  report 
has  not  been  completed;  however,  the  Safety  Board  has  reviewed  a  draft  of  the  final  report  and  reflected  its 
content  in  this  analysis. 
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heading,  the  signatures  would  have  included  changes  in  indicated  airspeed  and  altitude 
resulting  from  the  effects  of  the  low  ambient  pressure  within  the  rotor.  None  of  these 
expected  pressure  signatures  were  found.  Although  encounters  with  translating  rotors  at 
certain  angles  might  not  produce  these  pressure  signatures,  the  masking  of  the  FDR 
signatures  would  occur  only  while  an  airplane  was  entering  such  a  rotor.  United  flight  585 
could  not  have  penetrated  a  rotor’s  low  pressure  core  and  remained  there  for  8  seconds 
(the  time  that  the  airplane  would  have  had  to  remain  in  the  rotor  for  the  heading  output  and 
the  flightpath  to  match  the  FDR  data)  without  pressure  changes  from  the  rotor  producing 
changes  in  airspeed  and  altitude.  Further,  none  of  the  sounds  that  are  normally 
characteristic  of  intense  rotors  were  recorded  by  the  accident  airplane’s  CVR,  and 
witnesses  on  the  ground  did  not  report  such  sounds  at  the  time  and  location  of  the 
accident. 

On  the  basis  of  the  absence  of  the  signatures  of  a  rotor  penetration  on  the  FDR,  the 
absence  of  recorded/reported  characteristic  rotor  sounds,  and  the  small  likelihood  that  a 
rotor  of  the  necessary  strength  and  orientation  would  have  matched  the  airplane’s 
flightpath  to  the  point  of  ground  contact,  the  Safety  Board  concludes  that  it  is  very 
unlikely  that  the  loss  of  control  in  the  United  flight  585  accident  was  the  result  of  an 
encounter  with  a  mountain  rotor. 

2.3.2  United  Flight  585  Human  Performance  Analysis 

On  the  day  of  the  United  flight  585  accident,  pilots  flying  in  the  area  of  the 
Colorado  Springs  airport  had  reported  moderate  to  severe  turbulence,  gusty  winds,  and 
windshear.  Information  recorded  by  the  CVR  and  FDR  indicated  that,  as  the  captain  (who 
was  the  flying  pilot)  maneuvered  the  airplane  in  the  traffic  pattern,  the  airplane 
encountered  wind  gusts  and  windshear  that  resulted  in  10-knot  airspeed  changes.  Because 
of  the  turbulence  and  wind  gusts,  and  because  he  was  preparing  for  a  crosswind  landing, 
the  Safety  Board  considers  it  likely  that  the  captain  had  his  feet  on  the  rudder  pedals  as  he 
aligned  the  airplane  on  its  final  approach. 

According  to  the  Safety  Board’s  best-match  computer  simulation,  about  0943:20, 
the  airplane  rolled  rapidly  (about  10°  per  second)  to  the  right  to  a  bank  angle  of  about  27° 
and  returned  to  approximately  a  level  flight  attitude.  This  bank  was  entered  more  rapidly 
and  was  steeper  than  the  bank  a  pilot  would  likely  have  commanded  for  a  heading 
adjustment  to  track  the  extended  centerline  of  the  runway.  Consequently,  the  Safety  Board 
assumed  that  the  right  roll  was  caused  by  an  eddy  or  rotational  wind  component.  (The 
recovery  from  this  right  roll,  however,  was  presumed  to  have  been  a  result  of  control 
wheel  inputs  made  by  the  captain  beginning  about  1  second  after  the  airplane’s  roll 
accelerated  to  the  right.) 

The  Safety  Board’s  review  of  the  CVR,  FDR  and  radar  information  revealed  that, 
about  0943:28  (8  seconds  after  the  27°  uncommanded  right  roll),  the  airplane  was  flying  at 
160  knots  with  30°  of  flaps  and  the  landing  gear  extended  and  was  nearly  aligned  on  the 
final  approach  for  the  runway.  According  to  the  CVR,  at  0943:28.2,  the  first  officer 
advised  “we’re  at  a  thousand  feet  [above  the  ground].”  The  FDR  indicated  that,  about 
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0943:30,  another  right  heading  change  began  and  continued  at  a  rate  of  4.7°  per  second. 
In  its  computer  simulation,  the  Safety  Board  matched  this  heading  change  by  introducing 
a  crosswind  gust  component,  resulting  in  right  yaw.  The  yaw  rate  was  sustained  for  more 
than  3  seconds  before  a  rapid  right  roll  developed.  This  sustained  yaw  would  have  been 
apparent  to  the  captain  as  motion  of  the  ground  and  sky  features  relative  to  the  fixed 
reference  of  the  airplane’s  windshield  area.  This  heading  change  would  have  been 
especially  salient  to  the  captain  because  the  runway,  with  which  he  was  trying  to  maintain 
alignment,  would  have  been  visible  ahead. 

The  Safety  Board’s  simulation  scenario  assumed  that  the  captain  responded  to  the 
sudden,  rapid,  and  sustained  heading  change  by  applying  left  rudder  pedal  input  about 
0943:32.  The  timing  of  this  input  (about  3  seconds  after  the  peak  yaw  rate  was  attained) 
would  be  consistent  with  the  time  required  for  the  pilot  to  perceive  the  yaw,  wait  a 
moment  for  the  effect  of  the  turbulence  to  subside  (to  avoid  overcontrolling),  decide  that  a 
left  rudder  input  was  required,  and  then  apply  the  left  rudder  pedal  input.  The  Safety 
Board’s  simulation  postulated  that  this  left  rudder  input  initiated  a  rudder  reversal  to  the 
right.  According  to  the  Safety  Board’s  simulation,  at  0943:33.5  (about  1.5  seconds  after 
the  rudder  reversal  began),  when  the  captain  signaled  his  decision  to  abandon  the 
approach  by  stating  “fifteen  flaps,”  the  bank  angle  had  not  exceeded  20°,  and  the  pitch 
angle  was  8°  nose  down  (approximately  what  it  had  been  during  the  normal  descent  in  the 
period  leading  up  to  the  upset).  However,  speech  analysis  indicated  that  the  captain  s 
“fifteen  flaps”  statement  displayed  a  heightened  level  of  speech  fundamental  frequency 
that  was  consistent  with  a  sense  of  urgency.  This  sense  of  urgency  was  also  indicated  by 
the  captain’s  omission  of  a  call-out  item  in  the  normal  go-around  procedure.  Although 
many  factors  may  have  precipitated  a  go-around  decision  by  the  captain,  a  flight  control 
difficulty,  such  as  that  produced  by  a  rudder  reversal,  would  have  been  consistent  with  the 
captain’s  speed  and  urgency  in  making  this  decision. 

If  the  captain  applied  force  to  the  left  rudder  pedal,  he  would  have  felt  the  pedal 
push  strongly  back  against  his  foot  pressure.  Further,  the  Safety  Board  assumed  that  the 
captain  would  have  acted  to  oppose  a  continuing  uncommanded  right  yaw  that  was  being 
sustained  by  a  reversing  rudder;  thus,  the  Safety  Board’s  computer  simulation  of  the  event 
increased  the  captain’s  force  on  the  left  rudder  pedal  to  300  pounds  within  1  second.^^’ 

During  postaccident  simulator  exercises,  the  Safety  Board  detemuned  that  an 
immediate  full  left  control  wheel  response  during  a  right  rudder  reversal  in  the  airspeed 
and  flap  configuration  of  United  flight  585  could  have  allowed  the  flight  crew  to  maintain 
control  of  the  airplane.  However,  during  a  rudder  jam  and  reversal,  the  captain  of  United 
flight  585  would  have  been  contending  with  the  distraction  of  the  malfunctioning  rudder 
and  thus  would  have  been  devoting  his  physical  effort  to  overpowering  the  rudder  pedals. 
Further,  the  airplane’s  yawing  motion  and  heading  changes  (derived  from  the  Board  s 


The  captain  did  not  state  aloud  “go-around  thrust,”  as  specified  in  United’s  go-around  procedure. 

Although  the  Safety  Board’s  best-match  simulation  used  300  pounds  of  force  reducing  to  200 
pounds,  based  on  ergonomic  and  other  research  data  (as  discussed  in  section  1.18.8),  the  Safety  Board  was 
also  able  to  obtain  an  excellent  match  with  the  FDR  data  using  only  the  minimum  pedal  force  necessary  to 
sustain  full  rudder  authority  (about  70  pounds)  and  using  500  pounds  of  force. 
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computer  simulations)  would  have  produced  stronger  cues  than  those  produced  by  the 
rolling  motion  during  the  first  few  seconds  of  the  upset,  so  the  captain  was  likely  focusing 
his  attention  on  the  rapid  yaw  acceleration  that  he  could  not  control  with  the  rudder. 

These  circumstances  would  have  been  extremely  confusing  and  distracting  and 
would  have  been  unknown  to  the  flight  crew  based  on  previous  experience.  Thus,  it 
would  be  understandable  for  the  captain  to  have  initially  made  a  partial  wheel  input  while 
contending  with  the  powerful  physical  and  mental  demands  of  the  problem  with  the 
rudder.  The  CVR  evidence  of  increasing  engine  thrust  indicated  that  the  captain  would 
have  been  using  his  right  hand  to  advance  the  thrust  levers  for  an  attempted  go-around. 
Thus,  the  captain  would  have  had  only  his  left  hand  available  to  rotate  the  wheel  to  the 
left,  which  would  have  made  it  difficult  to  achieve  large  left  control  wheel  deflections. 
(This  motion  would  have  required  the  captain  to  pull  his  left  arm  down  and  across  his 
body  while  twisting  his  left  wrist.) 

Further,  at  the  time  of  the  left  rudder  input  in  the  Safety  Board’s  simulation,  the 
airplane  was  in  about  a  5°  right  bank.  According  to  the  Board’s  assumption  that  the 
captain  applied  moderate  left  wheel  (about  one-third  of  the  available  control  wheel)  about 
2  seconds  later,  the  airplane  would  have  been  in  a  right  bank  of  about  30°.  On  the  basis  of 
the  time  required  for  the  captain  to  perceive  the  need  for  and  execute  his  control  input 
(about  %  second),  the  bank  angle  that  the  captain  would  have  been  responding  to  with  this 
moderate  control  wheel  input  was  about  15°.  With  this  relatively  shallow  roll  angle,  it 
would  be  normal  for  a  pilot  (especially  an  air  carrier  pilot)  to  first  apply  a  moderate 
control  input  and  then  gauge  the  airplane’s  response  before  making  an  extreme  control 
input.  (The  Safety  Board  considers  it  likely  that  the  first  officer’s  statement  “Oh  God”  at 
0943:32.6  referred  to  her  concerns  about  the  abrupt,  sustained  yaw  rate  and  heading 
change  resulting  from  the  rudder’s  reversal  movement  to  its  right  blowdown  limit  and  not 
about  the  airplane’s  roll  attitude  or  rate  of  change  because  the  roll  attitude  was  not 
excessive  at  that  time.)  The  Safety  Board’s  computer  simulation  further  indicated  that  the 
captain  applied  full  control  wheel  to  the  left  about  2  seconds  later. 

The  computer  simulation  results  also  indicated  that,  within  2  seconds  of  rudder 
reversal,  the  pilots  were  experiencing  as  much  as  0.44  G  of  sideforce  from  the  right  yaw 
acceleration.  This  sideforce  would  have  made  a  left  wheel  input  even  more  difficult  for 
the  captain  because  his  body  would  have  been  pulled  to  the  left  and  away  from  the  control 
wheel,  causing  a  tendency  to  level  the  wheel  unless  he  quickly  returned  his  right  hand  to 
the  controls. 

Therefore,  because  of  the  unknown  nature  of  a  rudder  reversal,  the  initially 
shallow  roll  angle,  and  the  physical  limitations  that  would  have  hindered  an  immediate 
full  left  control  wheel  input,  the  Safety  Board  considers  it  understandable  that  the  captain 
might  not  have  immediately  applied  a  full  left  control  wheel  input  to  counter  a  reversing 
rudder. 


The  Safety  Board’s  computer  simulation  showed  that,  about  0943:34,  the  bank 
angle  of  the  airplane  transitioned  suddenly;  by  about  0943:35,  only  3  seconds  after  the 
reversal,  the  right  bank  angle  had  increased  to  more  than  80°.  The  Safety  Board’s 
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simulation  also  showed  that  the  captain,  at  that  time,  rapidly  moved  the  control  wheel 
fully  to  the  left.  The  airplane’s  pitch  angle  had  decreased  to  almost  30°  nose  down,  and 
the  pilots  would  have  been  able  to  see  only  the  ground  through  the  windshield.  The  Safety 
Board  would  expect  that  the  captain  would  no  longer  be  applying  as  much  force  to  the  left 
rudder  pedal  because  he  was  likely  focusing  on  holding  a  full  left  wheel  input  and 
attempting  a  go-around  and  the  left  rudder  pedal  would  have  forced  him  to  a  less  efficient 
knee  angle.  Consequently,  the  Board’s  computer  simulation  of  the  event  moderated  the 
captain’s  force  on  the  left  rudder  pedal  to  200  pounds  at  that  time. 

Shortly  thereafter  (perhaps  in  response  to  the  loss  of  attitude  reference),  the  captain 
apparently  removed  some  of  his  left  wheel  inputs,  possibly  because  he  was  concentrating 
on  aft  control  column  pressure  in  an  attempt  to  raise  the  airplane  s  nose.  By  about 
0943:36,  the  airplane  rolled  into  an  inverted  attitude  and  the  captain  said  “no”  very  loudly. 
Ground  impact  occurred  about  5  seconds  later,  only  9  seconds  after  the  rudder  reversal 
began. 

The  Safety  Board  concludes  that  analysis  of  the  CVR,  Safety  Board  computer 
simulation,  and  human  performance  data  (including  operational  factors)  from  the  United 
flight  585  accident  shows  that  they  are  consistent  with  a  rudder  reversal  most  likely 
caused  by  a  jam  of  the  main  rudder  PCU  servo  valve  secondary  slide  to  the  servo  valve 
housing  offset  from  its  neutral  position  and  overtravel  of  the  primary  slide.  Also,  because 
the  United  flight  585  upset  occurred  when  the  airplane  was  less  than  1,000  feet  above  the 
ground,  the  pilots  had  very  little  time  to  react  to  or  recover  from  the  event.  Thus,  the 
Safety  Board  concludes  that  the  flight  crew  of  United  flight  585  recognized  the  initial 
upset  in  a  timely  manner  and  took  immediate  action  to  attempt  a  recovery  but  did  not 
successfully  regain  control  of  the  airplane.  The  Safety  Board  further  concludes  that  the 
flight  crew  of  United  flight  585  could  not  be  expected  to  have  assessed  the  flight  control 
problem  and  then  devised  and  executed  the  appropriate  recovery  procedure  for  a  rudder 
reversal  under  the  circumstances  of  the  flight.  The  Safety  Board  also  concludes  that  the 
training  and  pilot  techniques,  developed  as  a  result  of  the  US  Air  flight  427  accident  show 
that  it  is  possible  to  counteract  an  uncommanded  deflection  of  the  rudder  in  most  regions 
of  the  flight  envelope;  such  training  was  not  yet  developed  and  available  to  the  flight 
crews  of  US  Air  flight  427  and  United  flight  585. 

2.4  Eastwind  Flight  517  Upset 

The  logbook  records  for  the  Eastwind  flight  517  airplane  indicated  that  a  series  of 
flight  crew-reported  rudder-related  anomalies  (uncommanded  rudder  movements  and 
rudder  pedal  “bumps”)  occurred  during  the  month  before  the  upset  event.  As  a  result  of 
these  anomalies,  the  main  rudder  PCU  was  removed  and  replaced  on  May  14,  1996,  and 
the  yaw  damper  transfer  valve  and  yaw  damper  position  transducer  were  removed  and 
replaced  on  June  8, 1996.”^  The  captain  of  the  incident  flight,  who  had  experienced  some 
of  the  previous  rudder  pedal  bumps,  conducted  the  postmaintenance  flight  test  on  the 


On  June  2,  1996,  Eastwind  issued  a  bulletin  to  all  flight  crews  advising  them  to  report  any 
“unexplained”  yaw  events. 
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morning  of  the  incident  flight.  The  captain  noted  no  rudder  system  anomalies  during  the 
test  flight  or  the  incident  flight  until  the  upset  event  began. 

The  Safety  Board’s  postincident  examination  of  the  incident  airplane’s  rudder 
system  components  revealed  several  anomalous  conditions,  including  a  misadjusted  yaw 
damper  linear  variable  displacement  transducer  (LVDT)  and  chafed  wiring  between  the 
yaw  damper  coupler  and  the  main  rudder  PCU.  Either  of  these  conditions  might  have 
resulted  in  anomalous  rudder  behaviors.  The  misadjusted  LVDT  would  have  changed  the 
yaw  damper’s  authority  over  the  rudder  from  the  specified  3°  left  or  right  of  neutral  to  1 .5° 
left  of  neutral  to  4.5°  right  of  neutral  with  no  aerodynamic  loads  on  the  rudder.  Chafed 
wiring  could  cause  a  short  circuit,  which  could  result  in  a  yaw  damper  hardover  command. 
Although  the  Safety  Board  was  unable  to  positively  identify  the  source  of  the  rudder- 
related  anomalies,  a  short  circuit  related  to  the  chafed  wiring  may  have  caused  a  yaw 
damper  hardover  during  the  incident.^^® 

Safety  Board  simulations  and  Boeing  kinematics  studies  revealed  that  the  heading 
change  observed  in  the  Eastwind  airplane’s  FDR  data  required  a  right  rudder  deflection  of 
about  6  to  6.5°.  This  rudder  movement  is  larger  than  the  yaw  damper  could  command 
(even  allowing  for  the  misrigged  LVDT  and  compliance  in  the  system,  the  yaw  damper 
could  only  command  3.95°  of  right  rudder  movement  in  flight).^'*®  Further,  although 
examination  of  the  Eastwind  flight  517  PCU  components  revealed  a  higher-than-normal 
hydraulic  fluid  leakage  at  the  bypass  valve  (resulting  in  a  reduced  hinge  moment,  which 
would  result  in  a  reduced  blowdown  rudder  deflection),^'**  the  aerodynamic  blowdown 
limit  for  the  Eastwind  flight  517  incident  airplane,  assuming  normal  (unreversed) 
operation,  far  exceeded  the  6  to  6.5°  rudder  deflection  that  was  apparently  involved  in  the 
incident.^'*^ 

Examination  of  internal  measurements  of  the  Eastwind  flight  517  PCU  servo  valve 
revealed  that  it  had  relatively  tight  clearances,  similar  to  those  measured  in  the  USAir 
flight  427  PCU  servo  valve.  Thus,  the  Eastwind  servo  valve  (similar  to  the  USAir  servo 


The  postincident  removal  and  replacement  of  all  components  and  wiring  associated  with  the  incident 
airplane’s  yaw  damper  system  apparently  eliminated  the  source  of  the  rudder  bumps;  since  then,  there  have 
been  no  pilot  complaints  or  maintenance  writeups  regarding  rudder  bumps  or  other  anomalous  rudder 
behavior. 

Although  the  misadjusted  LVDT  allowed  for  4.5°  of  movement  to  the  left  on  the  ground,  the  rudder 
movement  with  aerodynamic  loads  in  flight  would  have  been  3.7°.  This  estimate  has  an  error  band  of 
±  0.25°,  yielding  an  estimated  maximum  right  rudder  deflection  (caused  by  the  yaw  damper)  of  3.95°. 

Although  the  bypass  valve  allowed  higher-than-normal  leakage,  which  affected  the  rudder’s 
blowdown  deflection,  the  leakage  was  not  significant  enough  to  prevent  the  Eastwind  PCU  from 
successfully  completing  Parker’s  acceptance  test  procedure  functional  tests  at  the  full  PCU  level.  However, 
when  the  bypass  valve  was  removed  from  the  PCU  package  and  tested  independently,  it  did  not  successfully 
complete  the  bypass  valve  functional  tests. 

According  to  Boeing,  the  rudder  blowdown  limits  for  the  Eastwind  flight  517  incident  airplane 
(including  the  reduced  hinge  moment  from  the  PCU’s  excessive  leakage  at  the  bypass  valve)  would  have 
been  about  9°  when  operating  at  250  knots  under  normal  (unreversed)  pilot  command,  with  the  variation 
depending  on  the  sideslip  value. 
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valve)  would  be  more  likely  to  jam  than  a  servo  valve  with  greater  clearances  (such  as  the 
new-production  PCU  servo  valve  also  subjected  to  these  tests). 

2.4.1  Eastwind  Flight  517  Computer  Simulation  Analysis 

Eastwind  flight  517  was  equipped  with  an  11-parameter  FDR  that  included  vertical 
acceleration,  pitch,  roll,  and  heading.  Because  heading  data  were  recorded  only  once  per 
second,  several  computer  simulations  resulted  in  reasonable  matches  of  the  FDR  heading 
data  (and  vertical  acceleration,  pitch,  and  roll  data).  (FDR  heading  data  sampled  at  more 
frequent  intervals  would  have  likely  resulted  in  fewer  computer  simulations  that  match  the 
data  reasonably  well.)  The  Safety  Board’s  best-match  simulation  assumes  that  the  rudder 
surface  was  trimmed  to  neutral  to  compensate  for  the  offset  yaw  damper.  This  scenario 
also  assumes  that,  about  2210:31,  the  pilot  stepped  on  the  left  rudder  pedal  to  counter  a 
yaw  damper  hardover  of  3.95°  to  the  right  that  had  occurred  about  2  seconds  earlier;  the 
yaw  damper  hardover  created  a  yaw  acceleration  that  peaked  at  more  than  7°/sec^  and  a 
lateral  acceleration  in  the  cockpit  above  0.1  G.  This  scenario  further  assumes  that  the 
secondary  slide  was  jammed  to  the  servo  valve  housing  about  55  percent  off  neutral  and 
that,  when  the  pilot  applied  force  to  the  left  rudder  pedal,  the  rudder  moved  in  a  direction 
opposite  that  commanded  to  about  6.5°  right  (the  blowdown  limit  with  the  leaking  bypass 
valve  and  the  reduced  rudder  hinge  moment  from  the  secondary  slide  jam  at  55  percent 
from  neutral). 

The  Safety  Board’s  simulation  results  matched  each  FDR  heading  and  roll  data 
point  within  about  1°.  The  results  also  matched  well  with  the  FDR  recorded  vertical 
acceleration  data. 

Boeing  proposed  a  scenario  in  which  a  yaw  damper  hardover  of  3°  right  (from  1.5° 
left  because  of  the  misrigged  LVDT)  occurred  during  the  ground  roll.  Boeing  further 
proposed  that  the  pilots  added  3°  of  left  rudder  trim  to  compensate  for  the  yaw  damper 
input.^"*^  According  to  Boeing’s  scenario,  the  fault  that  initially  moved  the  yaw  damper  to 
3°  right  cleared  just  before  2210:28,  and  the  rudder  then  moved  rapidly  3.7°  to  the  left, 
resulting  in  a  left  yaw  about  2210:28.  Boeing’s  scenario  indicated  that  the  pilot  responded 
with  right  rudder  pedal,  commanding  the  rudder  to  about  6°  right  and  causing  the  airplane 
to  yaw  right.  In  Boeing’s  scenario,  the  pilot  maintained  the  right  rudder  pedal  input,  and 
the  yaw  damper  remained  active  and  responded  appropriately.^'*^ 

Boeing  used  its  kinematic  analysis  to  derive  flight  control  surface  position  time 
histories  (particularly  the  rudder  position  time  history).  This  effort  required  Boeing  to 
curve  fit  the  once-per-second  FDR  heading  data,  which  Boeing  accomplished  with  a 
manual,  nonlinear  fit  of  the  heading  data,  as  shown  in  figure  32.  To  justify  a  right  rudder 


The  Eastwind  pilots’  statements  indicated  that  the  yaw  damper  behaved  normally  during  the 
maintenance  test  flight  that  occurred  before  the  incident  flight  and  was  observed  in  the  neutral  position 
during  the  ground  operations  before  takeoff  of  the  incident  flight. 

The  Boeing  scenario  was  described  in  its  August  14,  1998,  Submissions  Supplement  to  the  USAir 
flight  427  accident  investigation.  In  a  document  dated  February  24,  1999,  Boeing  provided  updated  data  in 
support  of  its  scenario. 
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input  by  the  pilot  about  2210:29,  Boeing  introduced  a  left  heading  change  between 
2210:28  and  2210:29  (in  response  to  the  postulated  left  rudder  movement  from  the  release 
of  the  yaw  damper  hardover  about  2210:28)  through  its  manual  nonlinear  curve  fit  of  the 
FDR  heading  data,  even  though  the  FDR  data  did  not  reflect  a  left  heading  change. 
(Further,  both  the  flight  crew  and  the  lead  flight  attendant  recalled  a  yaw  to  the  right  as  the 
initiating  event.).  When  this  manual  curve  fit  of  the  heading  data  was  used  in  Boeing’s 
kinematic  analysis,  the  results  indicated  a  left  rudder  movement  about  2210:28  that  was 
consistent  with  Boeing’s  scenario  of  the  release  of  the  yaw  damper  hardover  at  that  time. 
Boeing  then  used  this  rudder  surface  time  history  (and  other  control  surface  time  histories) 
as  input  data  in  its  computer  simulation  to  produce  airplane  motion  parameters,  including 
heading. 


Eastwind  Event 
Boeing  Solution 

from  fig  16  of  August  14,  1998  submittal 


Figure  32.  Boeing’s  curve  fit  of  the  FDR  heading  data  from  Eastwind  flight  517. 

Boeing  asserted  that  its  analysis  demonstrated  rudder  activity  during  the  event, 
which  it  considered  evidence  of  the  yaw  damper  activity  during  the  event  (and  therefore 
evidence  that  the  rudder  was  not  jammed  and  did  not  reverse).  However,  the  basis  for  this 
assertion  that  the  yaw  damper  was  active  during  the  event  is  the  rudder  activity  resulting 
from  Boeing’s  kinematic  analysis,  which  in  turn  resulted  from  Boeing’s  manual,  nonlinear 
curve  fit  of  the  FDR  heading  data.  Although  the  Safety  Board  cannot  prove  that  the  left 
heading  change  introduced  into  Boeing’s  curve  fit  about  2210:28  did  not  exist,  no 
evidence  indicates  that  it  did.  Further,  the  heading  change  does  not  match  the  character  of 
the  heading  data  between  about  2210:27  and  about  2210:30. 

Further,  Boeing  used  the  rudder  time  history  resulting  from  its  kinematic  analysis 
and  the  concomitant  rudder  activity  to  conclude  that  the  yaw  damper  was  active. 
However,  because  of  the  noise  inherent  in  the  curve-fitting  process,  these  results  do  not 
prove  that  the  yaw  damper  was  active  but  only  allow  for  this  possibility.  The  Safety 
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Board’s  computer  simulations,  which  assumed  that  the  secondary  slide  jammed  to  the 
servo  valve  housing  about  55  percent  from  its  neutral  position  after  the  pilot  input  left 
rudder  (about  2210:30)  in  response  to  a  right  yaw  damper  hardover  (about  2210:28),  did 
not  require  yaw  damper  activity  to  achieve  its  match. 

Boeing’s  computer  simulation  results  and  the  Safety  Board’s  results  matched  the 
FDR  data  well,  with  the  resulting  heading  data  from  both  simulations  matching  the  FDR 
heading  data  within  1°.  Further,  within  the  approximately  12  seconds  of  significance 
(about  2210:28  to  about  2210:40),  the  character  of  the  resulting  heading  data  from  both 
the  Boeing  and  Safety  Board  simulations  is  generally  consistent  with  the  character  of  the 
FDR  heading,  except  for  the  hump  in  the  heading  data  between  2210:28  to  2210:29 
introduced  by  Boeing’s  curve  fit  for  its  kinematic  analysis. 

Boeing’s  simulation,  however,  suffers  from  a  timing  deficiency:  its  simulation 
presumes  a  right  pedal  input  by  the  pilot  about  Vi  second  after  the  postulated  clearing  of 
the  yaw  damper  hardover  in  reaction  to  a  heading  change  of  less  than  0.5  and  a  peak 
heading  change  rate  of  only  1.4°  per  second.  Further,  Boeing’s  simulation  results  in  a  6° 
right  rudder  deflection.  However,  the  blowdown  limit  for  Eastwind  flight  517  at  that  time 
(without  a  reversal  scenario)^'^^  would  have  been  about  9°,  even  with  the  higher  bypass 
leakage  rate.  Thus,  the  Boeing  scenario  requires  that  the  pilot  only  partially  depress  the 
right  rudder  pedal  to  move  the  rudder  surface  to  match  the  simulation  deflection. 

2.4.2  Eastwind  Flight  517  Human  Performance  Analysis 

The  captain  of  Eastwind  flight  517  had  adopted  a  personal  technique  of  routinely 
disengaging  the  autopilot  as  his  airplane  descended  through  10,000  feet  mean  sea  level 
(msl).  Consequently,  when  Eastwind  flight  517  approached  Richmond  on  the  night  of  the 
incident,  the  captain  was  hand  flying  the  airplane  with  his  feet  on  the  rudder  pedals. 

The  weather  on  the  night  of  the  incident  was  reported  to  be  clear  with  relatively 
calm  winds.  The  airplane  was  descending  through  4,300  feet  msl  when  the  captain  felt  a 
motion  that  he  later  described  as  a  “bump”  on  the  right  rudder  pedal.  The  captain  reported 
that,  almost  immediately  afterward,  he  felt  a  sharp  yaw  to  the  right  followed  by  a  right 
roll.  The  captain  stated  that  the  rudder  pedals  displayed  little,  if  any,  displacement.  This 
report  is  consistent  with  the  3.95°  nose  right  yaw  damper  hardover  about  2210.29  in  the 
Safety  Board’s  computer  simulation  scenario. 

In  postincident  interviews  with  Safety  Board  investigators,  the  captain  stated  that 
he  immediately  applied  “opposite  [left]  rudder  and  stood  pretty  hard  on  the  pedal.  He 
said  that  the  “rudder  moved,  but  felt  stiffer  than  normal.”  The  first  officer  told 
investigators  that  he  observed  the  captain  “fighting,  trying  to  regain  control”  and 
“standing  on  the  left  rudder  [pedal].”  The  captain  further  stated  that  the  rudder  pedal 
moved  but  did  not  depress  to  the  floor.  He  believed  that  these  actions  slowed  the  event  but 
that  the  airplane  was  still  trying  to  roll. 


In  a  reversal  scenario,  the  leaking  bypass  valve  and  the  reduced  hinge  moment  caused  by  a 
secondary  slide  jam  would  have  reduced  the  blowdown  limit  to  6.5°. 
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These  pilot  statements  are  consistent  with  the  Safety  Board’s  computer  simulation 
scenario  in  which  the  main  rudder  PCU  servo  valve’s  secondary  slide  jammed  and  the 
rudder  moved  in  the  direction  opposite  to  that  commanded  by  the  pilot.  The  Safety 
Board’s  simulation  studies  indicated  that,  after  the  rudder  initially  deflected  3.95°  to  the 
right,  it  increased  its  deflection  to  about  6.5°  to  the  right  within  the  next  2  seconds.  This 
2-second  period  from  yaw  damper  hardover  to  reversal  of  the  rudder  was  adequate  time 
for  the  captain  to  perceive  the  effects  of  the  yaw  damper  hardover  as  a  sideload  upon  his 
body  and  react  with  left  rudder  input.  The  Safety  Board’s  computer  simulation  assumed 
that  this  left  rudder  input  initiated  a  rudder  reversal  by  causing  the  primary  slide  of  the 
servo  valve  to  overtravel. 

Thus,  as  the  captain  added  left  rudder  pedal  input,  under  the  Safety  Board’s  rudder 
reversal  scenario,  the  rudder  would  have  moved  the  remainder  of  the  distance  to  its  right 
blowdown  limit  (to  about  6.5°  right)  with  little  movement  of  the  left  rudder  pedal  back 
against  the  captain’s  foot.  Under  the  assumption  that  the  captain  continued  to  apply  an 
increasing  amount  of  force  to  the  left  rudder  pedal  to  counter  the  right  yaw/roll  (from  the 
reversing  rudder),  the  left  rudder  pedal  would  have  moved  slightly  forward  without 
removing  the  uncommanded  right  rudder  deflection.  The  rudder  pedal  motion  and  force 
required  to  move  the  pedal  are  consistent  with  the  captain’s  report  of  rudder  pedals  that 
moved  but  felt  “stiffer  than  normal.”  Further,  because  both  pilots  reported  that  the  captain 
exerted  substantial  force  on  the  left  rudder  pedal  (by  “standing  on”  it),  the  Safety  Board’s 
computer  simulation  of  the  jam/reversal  scenario  modeled  the  captain’s  rudder  pedal  force 
as  an  increase  to  500  pounds  within  1  second.^'^® 

The  captain  stated  that,  as  the  event  continued,  his  wheel  inputs  appeared  to  stop 
the  roll  but  did  not  correct  the  condition.  The  captain  increased  the  right  engine’s  power, 
hoping  that  differential  engine  thrust  would  counter  the  airplane’s  right  yaw/roll. 
According  to  the  FDR,  when  the  right  engine’s  thrust  increased,  the  captain’s  initial 
control  inputs  had  recovered  the  airplane  from  its  right  rolling  moment  and  rolled  the 
airplane  back  through  level  flight  to  a  stable  left  bank  attitude  of  about  5  to  15°. 

The  Safety  Board’s  computer  simulation  shows  the  captain  relaxing  both  control 
wheel  and  rudder  inputs  about  2210:34  as  differential  engine  thrust  became  effective  and 
as  the  captain  attempted  to  restore  a  level  bank  attitude.  According  to  the  Safety  Board’s 
scenario  and  the  captain’s  recollection,  the  captain  had  achieved  a  stable,  though 
uncoordinated  (cross-controlled),  flight  condition  with  only  moderate  control  wheel  inputs 
required.  Given  the  stability  of  the  situation,  particularly  with  the  airplane  already  in  a  left 
bank,  it  would  have  been  reasonable  for  the  captain  to  have  relaxed  some  of  his  rudder 
pedal  and  control  wheel  inputs.  At  this  time,  the  Safety  Board’s  computer  simulation 
shows  the  captain  relaxing  his  rudder  pedal  force  to  250  pounds. 


Although  the  Safety  Board’s  best-match  simulation  used  500  pounds  of  force  reducing  to  250 
pounds,  based  on  ergonomic  and  other  research  data  (as  discussed  in  section  1.18.8),  the  Safety  Board  was 
also  able  to  obtain  excellent  matches  with  the  FDR  data  using  only  the  minimum  pedal  force  necessary  to 
sustain  full  rudder  authority  (about  70  pounds)  and  using  300  pounds  of  force. 
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The  captain  stated  that,  when  the  uncommanded  event  continued,  he  reached  for 
the  yaw  damper  switch  (located  on  the  overhead  panel  above  the  captain’s  head)  and 
disengaged  the  yaw  damper.  Seconds  later,  the  yaw/roll  event  ended  (about  12  seconds 
after  it  began,  according  to  FDR  data).  The  captain  stated  that  he  did  not  believe  the  end 
of  the  event  was  directly  related  to  the  yaw  damper  disengagement.  However,  the  Safety 
Board  considers  it  possible  that  the  captain  may  have  (unknowingly)  eased  his  pressure  on 
the  left  rudder  pedal  when  he  reached  for  the  yaw  damper  switch  or  afterward  as  he 
assessed  the  effect  that  the  yaw  damper  disengagement  had  on  the  yaw/roll  event.  (The 
Safety  Board  modeled  this  scenario  in  its  computer  simulation  of  the  event  with  a  further 
reduction  in  left  rudder  pedal  pressure  about  2210:40.)  If  the  captain  relaxed  his  force  on 
the  left  rudder  pedal  to  less  than  about  50  pounds,  a  rudder  reversal  resulting  from  a 
secondary  slide  jam  to  the  servo  valve  housing  might  have  ended  (that  is,  the  primary  slide 
might  have  returned  to  neutral  from  its  overtravel  position). 

Unlike  United  flight  585  and  USAir  flight  427,  Eastwind  flight  517  was  moving 
throughout  the  event  at  a  speed  that  remained  well  above  the  crossover  airspeed.  Thus, 
the  flight  crew  of  Eastwind  flight  517  had  sufficient  roll  control  authority  to  overcome  the 
effects  of  a  full  rudder  deflection.  This  roll  control  authority  was  clearly  a  factor  in  the 
ability  of  the  flight  crew  to  recover  from  the  event. 

In  addition  to  the  human  performance  aspects  of  the  Eastwind  flight  517  reversal 
scenario,  the  Safety  Board  reviewed  the  human  performance  aspects  of  the  pilot  input 
scenario  proposed  by  Boeing.  As  discussed  in  section  2.4.1,  Boeing’s  scenario  proposed 
that  a  yaw  damper  hardover,  which  had  occurred  while  on  the  ground  before  departure, 
resulted  in  a  constant  3.7°  right  rudder  input  at  the  beginning  of  the  flight.  The  scenario 
further  proposed  that  the  pilots  then  applied  an  equal  and  opposite  amount  of  left  rudder 
trim  so  that  the  rudder  surface  was  about  neutral  with  respect  to  the  vertical  fin. 

During  interviews  with  investigators,  the  captain  of  Eastwind  flight  517  did  not 
recall  having  trimmed  the  rudder  at  any  time  before  the  beginning  of  the  yaw/roll  incident. 
Further,  the  captain  indicated  that  he  never  used  more  than  Vi  unit  of  rudder  trim  during 
routine  flight  operations.  Therefore,  the  need  to  trim  the  rudder  by  more  than  3  units  (as 
indicated  in  Boeing’s  scenario)  would  most  likely  have  been  salient  and  memorable  to  the 
captain.  Further,  the  pilots  of  Eastwind  flight  517  had  been  aware  of  previous  rudder 
anomalies  with  the  incident  airplane,  and  they  had  test  flown  the  airplane  immediately 
before  the  incident  flight  to  verify  the  proper  function  of  the  rudder  system.  Therefore,  the 
pilots  would  have  been  more  likely  to  note  and  recall  a  requirement  for  3  units  of  rudder 
trim  if  it  had  occurred. 

Boeing’s  pilot  input  scenario  also  proposes  that  the  yaw  damper  hardovei;  released 
between  2210:28  and  2210:29  and  that  the  pilots  immediately  responded  to  the  resulting 
left  yaw  with  right  rudder  input.  This,  scenario  postulates  that  the  pilots  reacted  within  less 
than  14  second  after  the  beginning  of  the  rudder’s  leftward  motion.  (The  scenario  must 
include  such  a  rapid  pilot  response  to  the  postulated  release  of  the  yaw  damper  hardover 
because  the  entire  initiating  event — ^release  of  the  yaw  damper  hardover  and  pilot  right 
rudder  input — must  take  place  within  the  1-second  interval  between  the  FDR  heading  data 
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points  at  2210:28  and  2210:29,  or  the  Boeing  simulation  heading  time  history  would  not 
match  these  FDR  heading  data.) 

According  to  human  factors  literature  on  reaction  time,^'*^  it  is  unlikely  that  a  pilot 
could  detect  an  unusual  situation,  recognize  what  was  happening,  decide  how  to  respond, 
and  make  a  motor  response  in  a  time  period  as  little  as  14  second.  At  the  beginning  of  the 
postulated  yaw  damper  hardover  release,  no  substantial  cues  would  have  signaled  the 
Eastwind  pilots  to  respond  with  an  immediate  rudder  input.  The  motion  of  the  rudder 
from  the  yaw  damper  hardover  release  would  have  provided  no  feedback  to  the  rudder 
pedals.  Although  yaw  acceleration  (perceived  by  the  pilots  as  sideload)  would  have  begun 
almost  immediately  after  the  rudder  movement  started,  it  would  not  have  reached  0.05  G 
until  about  1/3  second  after  rudder  movement  began  and  its  peak  of  approximately  0. 1  G 
until  about  Vi  second  after  rudder  movement  began.^'^*  Airplane  heading,  which  could 
have  been  apparent  to  the  pilots  during  the  night  flight  as  motion  of  lights  on  the  ground 
relative  to  the  airplane,  would  have  changed  less  than  1°  during  the  14-second  period  after 
the  yaw  damper  hardover  release.  Consequently,  the  cues  that  might  have  alerted  the 
flight  crew  to  a  yaw  damper  hardover  release  would  not  have  developed  until  most,  or  all, 
of  the  14-second  period  had  elapsed.  Finally,  the  pilot  would  have  been  required  to  make  a 
foot  response,  which  can  be  20  percent  slower  than  a  hand  response.^^^ 

When  the  captain  of  Eastwind  flight  517  was  subjected  to  a  yaw  damper  handover 
in  the  test  flight  conducted  after  the  event,  he  took  3/5  second  to  initiate  a  rudder  pedal 
input  in  response  to  the  hardover.  This  reaction  time  is  probably  less  than  the  captain’s 
reaction  time  would  have  been  during  the  incident  flight  because  he  knew  the  test  flight 
would  involve  a  sudden  rudder  event  and  he  knew  exactly  how  to  respond.  Therefore,  on 
the  basis  of  these  human  reaction  time  capabilities,  the  flight  crew  of  Eastwind  flight  517 
would  not  have  likely  been  able  to  react  to  the  cues  from  an  unexpected  yaw  damper 
hardover  release  in  less  than  *4  second. 

To  match  the  FDR  data  from  the  Eastwind  flight  517  incident,  Boeing’s  pilot  input 
scenario  also  required  the  pilots  to  have  applied  and  held  about  6°  of  right  rudder  for  10 
seconds  or  more  after  the  postulated  yaw  damper  hardover  release.^^”  However,  the 
scenario’s  requirement  for  pilot  right  rudder  input  is  inconsistent  with  the  statements  of 
the  captain  and  first  officer:  both  recalled  that  the  captain  applied  left  rudder.  Further, 
both  pilots  recalled  that  the  captain  made  a  substantial  rudder  input  (describing  his  actions 


See  Sens,  M.J.,  Cheng,  P.H.,  Wiechel,  J.F.,  and  Guenther,  D.A.  1989.  Perception/reaction  time 
values  for  accident  reconstruction.  Warrendale,  Pennsylvania:  Society  of  Automotive  Engineers,  Paper 
890732.  Woodson,  W.E.,  and  Tillman,  B.  and  P.  1992.  Human  factors  design  handbook.  2"“*  edition.  New 
York:  McGraw-Hill,  Inc.  Also,  Boff,  K.R.,  and  Lincoln,  J.E.  1988  Engineering  data  compendium:  Human 
perception  and  performance.  Wright-Patterson  Air  Force  Base,  Ohio:  Armstrong  Aerospace  Medical 
Research  Laboratory. 

This  finding  was  based  on  Safety  Board  simulations  of  a  3.7°  rudder  step  input  under  the  existing 
flight  conditions. 

Woodson  and  Tillman,  p.  631. 

Slight  variations  in  the  rudder’s  position  during  this  time  period  were  proposed  by  Boeing  to  indicate 
variations  in  pilot  inputs  and/or  the  operation  of  the  yaw  damper.  See  section  2.4.1  for  more  information. 
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as  “standing  on  the  left  rudder  [pedal]”  and  “push[ing]  quite  hard”).  In  contrast,  if  the 
pilots  had  made  an  inappropriate  right  rudder  input  to  a  properly  functioning  rudder 
system  (as  the  Boeing  scenario  proposes)  to  achieve  a  6°  right  rudder,  the  captain  would 
have  had  to  apply  only  54  pounds  of  pressure  to  the  right  rudder  pedal,  depressing  the 
pedal  no  more  than  1  inch,  or  about  one-quarter  of  the  available  pedal  travel. 

A  forceful  full  right  rudder  input  with  a  normally  functioning  rudder  system  (based 
on  postincident  testing  of  the  Eastwind  flight  517  main  rudder  PCU  without  a  jam  and 
reversal)  would  have  resulted  in  the  right  rudder  pedal  depressing  to  its  forward  quadrant 
stops  (about  4.2  inches)  and  the  rudder  surface  moving  to  its  normal  blowdown  limit  of 
about  9°  right.  However,  simulations  of  the  Eastwind  flight  517  incident  performed  by 
both  the  Safety  Board  and  Boeing  indicate  that  a  9°  rudder  deflection  does  not  match  the 
FDR  data. 

The  Safety  Board  considers  it  highly  unlikely  that  the  pilots  of  Eastwind  flight  517 
would  have  forgotten  about  having  trimmed  the  rudder  by  more  than  3  units  before  the 
incident  began,  reported  applying  left  rudder  when  they  had  actually  applied  right  rudder, 
and  (perhaps  least  likely)  recalled  “standing  on  the  left  rudder”  when  the  captain  had 
actually  applied  only  a  light  touch  on  the  pedal.  The  Safety  Board  also  considers  it  very 
unlikely  that  the  pilots  could  have  reacted  to  the  postulated  yaw  damper  hardover  release 
in  less  than  14  second.  Therefore,  the  Safety  Board  does  not  consider  the  scenario 
proposed  by  Boeing  for  the  Eastwind  flight  517  incident  to  be  consistent  with  the 
available  evidence  from  the  FDR  and  the  flight  crew. 

On  the  basis  of  the  results  of  its  computer  simulation  (including  reduced  hinge 
moment)  and  analysis  of  the  human  performance  data  (including  postincident  flight  crew 
statements),  the  Safety  Board  concludes  that,  during  the  Eastwind  flight  517  incident,  the 
rudder  reversed,  moving  to  its  right  blowdown  limit  when  the  captain  commanded  left 
rudder,  consistent  with  a  jam  of  the  main  rudder  PCU  servo  valve  secondary  slide  to  the 
servo  valve  housing  offset  from  its  neutral  position  and  overtravel  of  the  primary  slide. 

2.5  Rudder  System  Jam  Scenarios 

In  its  examinations  of  the  rudder  systems  of  the  USAir  flight  427,  United  flight 
585,  and  Eastwind  flight  517  airplanes,  the  Safety  Board  was  unable  to  identify  any 
obvious  physical  evidence  that  a  jam  occurred  within  the  servo  valve.  Further,  the 
investigation  has  not  revealed  how  the  secondary  slide  could  jam  to  the  servo  valve 
housing  under  conditions  that  would  normally  be  encountered  by  an  airplane  in  air  carrier 
operations  and  not  leave  any  physical  evidence  that  the  jam  occurred.  However,  the 
Safety  Board  demonstrated  that,  in  servo  valves  with  tight  clearances,^^'  the  secondary 
slide  could  jam  to  the  servo  valve  housing  and  leave  no  physical  evidence  of  that  jam 
(albeit  under  thermal  conditions  that  would  not  normally  be  encountered  by  an  airplane  in 


The  Safety  Board’s  dimensional  examination  of  the  main  rudder  PCU  servo  valves  from  the  USAir 
flight  427  and  United  flight  585  accidents  and  the  Eastwind  flight  517  incident  revealed  that  the  USAir  and 
Eastwind  servo  valves  had  relatively  tight  clearances.  The  United  servo  valve  was  damaged  so  severely  that 
accurate  internal  measurements  could  not  be  obtained. 
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air  carrier  operations).  Further,  small  particulate  matter  in  the  hydraulic  fluid  could  reduce 
the  already  tight  clearances  in  the  servo  valve,  requiring  less  of  a  thermal  differential  for 
the  valve  to  jam.  In  addition,  it  is  possible  for  a  large  amount  of  small  particles  to  provide 
the  jamming  potential  of  a  larger  stronger  piece  of  metal  without  leaving  a  mark.^^^ 

Further,  testing  showed  that,  when  the  secondary  slide  was  jammed  to  the  servo 
valve  housing  and  a  sufficiently  high-rate  force  was  applied  on  the  input  crank, 
compliance  within  the  rudder  system  could  allow  the  primary  slide  to  overtravel  and  result 
in  a  reverse  rudder  command.  Therefore,  the  Safety  Board  concludes  that  it  is  possible 
that,  in  the  main  rudder  PCUs  from  the  USAir  flight  427,  United  flight  585,  and  Eastwind 
flight  517  airplanes  (as  a  result  of  some  combination  of  tight  clearances  within  the  servo 
valve,  thermal  effects,  particulate  matter  in  the  hydraulic  fluid,  or  other  unknown  factors), 
the  servo  valve  secondary  slide  could  jam  to  the  servo  valve  housing  at  a  position  offset 
from  its  neutral  position  without  leaving  any  obvious  physical  evidence  and  that, 
combined  with  a  rudder  pedal  input,  could  have  caused  the  rudder  to  move  opposite  to  the 
direction  commanded  by  a  rudder  pedal  input. 

In  one  or  more  of  the  three  upset  events,  the  main  rudder  PCU  system  could  have 
malfunctioned  in  some  way  other  than  the  rudder  reversal  scenario  previously  described 
such  that  the  rudder  moved  uncommanded  by  a  pilot  to  its  aerodynamic  blowdown  limit, 
without  leaving  any  physical  evidence,  just  before  the  pilot  commanded  opposite  rudder. 
However,  the  Safety  Board  is  unaware  of  any  mechanism  by  which  this  possibility  could 
have  occurred.  Such  a  malfunction  scenario  would  need  to  include  an  explanation  for  the 
reduction  in  the  rudder  hinge  moment  on  Eastwind  flight  517  to  be  consistent  with  the 
rudder  movement  during  that  upset  event. 

To  summarize,  the  Safety  Board’s  analysis  indicates  that  the  USAir  flight  427  and 
United  flight  585  accidents  and  the  Eastwind  flight  517  incident  involved  rudder 
deflections  that  could  have  only  been  the  result  of  inappropriate  pilot  input  or  a 
malfunction  of  the  rudder  system  (or  possibly  a  rotor  in  the  case  of  United  flight  585). 
The  Board  and  Boeing  were  able  to  perform  computer  simulations  and  kinematic  analyses 
involving  these  explanations  that  resulted  in  good  matches  of  the  available  FDR  data. 
Further,  Safety  Board  testing  showed  that  the  main  rudder  PCU  servo  valve  could  jam, 
without  leaving  a  physical  mark,  in  a  way  that  could  lead  to  rudder  reversal.  Additionally, 
in  all  three  upset  events,  the  available  human  performance  data  comported  well  with  a 
rudder  system  malfunction  but  were  inconsistent  with  an  inappropriate  pilot  input  (or  a 
rotor  in  the  case  of  United  flight  585). 

The  statements  of  the  Eastwind  flight  517  flight  crew  were  fully  consistent  with  an 
uncommanded  rudder  input.  In  addition,  the  Safety  Board’s  and  Boeing’s  computer 
simulation  and  kinematic  studies  both  indicated  that,  in  the  Eastwind  flight  517  incident, 
the  rudder  moved  to  a  position  consistent  with  rudder  reversal  but  inconsistent  with  a 
normally  operating  rudder  system  (given  the  pilots’  consistent  recollections  of  the  captain 
applying  great  force  to  the  rudder  pedals).  Therefore,  the  Safety  Board  concludes  that  the 


Safety  Board  tests  found  that  pieces  of  high-strength  material  could  jam  the  servo  valve  but  that  they 
would  leave  a  mark  as  a  result  of  the  jam. 
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upsets  of  US  Air  flight  427,  United  flight  585,  and  Eastwind  flight  517  were  most  likely 
caused  by  the  movement  of  the  rudder  surfaces  to  their  blowdown  limits  in  a  direction 
opposite  to  that  commanded  by  the  pilots.  The  rudder  surfaces  most  likely  moved  as  a 
result  of  jams  of  the  secondary  slides  to  the  servo  valve  housings  offset  from  their  neutral 
position  and  overtravel  of  the  primary  slides. 

In  addition  to  this  reversal  potential,  the  Safety  Board’s  investigation  revealed  two 
other  potential  failure  mechanisms^^^  within  the  737  rudder  control  system  that  could 
result  in  a  deflection  to  the  rudder’s  blowdown  limit.  One  of  these  potential  failure 
mechanisms  is  a  physical  jam  in  the  rudder  system  input  linkage  (between  the  PCU’s  input 
crank  and  body  stop),  preventing  the  main  rudder  PCU  control  valve  from  closing;  the 
other  is  a  jam  of  the  primary  to  the  secondary  slide  of  the  main  rudder  PCU  servo  valve 
combined  with  a  jam  of  the  secondary  slide  to  the  servo  valve  housing  at  positions  other 
than  neutral  (known  as  a  dual  jam).  These  failure  mechanisms  probably  did  not  play  a  role 
in  the  US  Air  flight  427,  United  flight  585,  and  Eastwind  517  upsets.^^'*  Nonetheless,  the 
failure  mechanisms  are  cause  for  concern  because  they  further  illustrate  the  vulnerability 
of  the  737  rudder  system  to  jams  that  could  produce  rudder  deflections  and  result  in 
catastrophic  consequences. 

2.6  Adequacy  of  the  Boeing  737  Rudder  System  Design 

Boeing  has  recently  made  significant  design  changes  in  the  737  rudder  system, 
especially  on  the  737-NG.  (The  design  changes  on  the  NG  series  airplanes  include  a 
redesigned  main  rudder  PCU  servo  valve  in  which  the  hydraulic  fluid  ports  are  spread, 
thus  eliminating  the  reversal  mechanism  identified  in  the  thermal  tests;  a  redesigned  yaw 
damper  system;  a  hydraulic  pressure  limiter;  a  rudder  input  force  transducer;  and  a  new 
standby  rudder  PCU  input  bearing.)  The  737-100  through  -500  series  airplanes  are  being 
retrofitted  with  the  redesigned  servo  valve  and  a  hydraulic  pressure  reducer  designed  to 
limit  the  extent  to  which  the  airplanes  would  be  vulnerable  to  the  rudder  overpowering  the 
roll  authority  of  the  ailerons  and  spoilers. 

As  a  result  of  ADs  issued  by  the  FAA,  the  redesigned  main  rudder  PCU  servo 
valve  should  eliminate  the  possibility  of  a  rudder  reversal  from  the  specific  circumstances 


A  third  potential  failure  mechanism — a  jam  of  the  primary  to  the  secondary  slide  with  overtravel  of 
the  secondary  slide— was  identified  as  a  result  of  testing  after  the  July  1992  United  Airlines  rudder  anomaly 
that  occurred  during  a  ground  check.  Although  the  testing  determined  that  this  mechanism  could  cause  a 
rudder  reversal,  Boeing  indicated  that  subsequent  design  changes  in  the  servo  valve  eliminated  this 
possibility. 

The  Safety  Board’s  postaccident  examination  of  the  USAir  flight  427  rudder  components  revealed 
that  the  rudder  system  feedback  control  loop  was  probably  not  jammed  during  the  accident  sequence 
because  there  was  no  evidence  of  foreign  material  to  cause  such  a  jam  and  there  were  no  nicks  or  gouges  on 
the  input  linkage  to  indicate  that  a  jamming  material  might  have  been  present  at  impact.  Further,  the  main 
rudder  PCU’s  external  input  linkage  effectively  covers  (blocks)  the  opiening  between  the  input  crank  and  the 
PCU  body  stop  for  the  left  rudder  command  direction,  preventing  jamming  material  from  entering  the  area. 
The  Safety  Board  considers  that  a  dual  slide  jam  is  a  less  likely  accident  scenario  than  a  jam  of  the  secondary 
slide  to  the  servo  valve  housing  because  the  dual  jam  would  require  two  extremely  rare  failures  to  exist  in 
the  servo  valve  at  the  same  time. 
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of  a  secondary  slide  jam  to  the  servo  valve  housing  combined  with  overtravel  of  the 
primary  slide.  Other  ADs  issued  by  the  FAA  should  result  in  improved  operational 
procedures  and  pilot  training  programs  for  addressing  the  more  general  problem  of 
uncommanded  movement  of  the  rudder,  including  rudder  reversal.  The  Safety  Board 
concludes  that,  when  completed,  the  rudder  design  changes  to  the  737  should  preclude  the 
rudder  reversal  failure  mode  that  most  likely  occurred  in  the  USAir  flight  427  and  United 
flight  585  accidents  and  the  Eastwind  flight  517  incident. 

However,  even  with  these  changes,  the  737  series  airplanes  (including  the  NG) 
remain  susceptible  to  rudder  system  malfunctions  that  could  be  catastrophic.  In  its 
October  1997  briefings  to  the  FAA,  Boeing  acknowledged  that  a  rudder  hardover  on  the 
737-NG  during  the  most  critical  phases  of  flight — ^takeoff  and/or  landing  (which  Boeing 
estimated  as  60  to  90  seconds  per  flight) — would  be  catastrophic.  Although  this  period  of 
vulnerability  appears  limited,  the  takeoff  and  landing  phases  are  when  the  pilot  is  most 
likely  to  use  the  rudder,  particularly  to  apply  a  high-rate  rudder  input.  Pilots  can  apply 
rudder  inputs  during  the  takeoff  or  landing  ground  roll  as  they  use  the  rudder  pedals  for 
nosewheel  steering;  these  inputs  can  occur  at  low  altitude  with  a  loss  of  engine  power  or 
during  a  turbulence  encounter.  Any  malfunction  resulting  in  uncommanded  rudder 
motion  during  an  engine  failure  or  in  turbulence  at  low  altitude  may  be  catastrophic 
because  of  the  limited  time,  altitude,  and  roll  control  authority  to  regain  control  of  the 
airplane. 

The  Board  is  also  concerned  that  the  limited  period  of  vulnerability  to  rudder 
malfunction  is  based  on  the  assumption  that  a  pilot  will  perform  perfectly  and  that  all 
airplane  systems  will  perform  normally.  For  example,  according  to  Boeing’s  fault  tree 
analysis  for  the  737-NG,  the  combination  of  a  jammed  servo  valve  with  a  loss  of  engine 
power  during  takeoff  would  be  catastrophic  only  during  a  7-second  window  from  V, 
through  liftoff,  at  which  point  roll  controls  could  be  used  to  help  control  the  airplane  in  the 
event  of  a  loss  of  engine  power.  However,  Boeing’s  analyses  apparently  assumed  that  a 
pilot  would  always  react  immediately  and  correctly  and  that  the  hydraulic  pressure  limiter 
would  not  fail.  Such  assumptions  may  not  be  fully  warranted. 

The  Safety  Board  recognizes  that  the  potential  for  the  specific  rudder  malfunction 
that  was  most  likely  involved  in  the  accidents  of  USAir  flight  427  and  United  flight  585 
and  the  incident  involving  Eastwind  flight  517  appears  to  be  have  been  eliminated  by  the 
redesigned  servo  valve.  However,  the  Board  remains  concerned  that  other  rudder  system 
malfunctions  might  potentially  lead  to  rudder  reversal  or  hardover  conditions  in  the  737. 

The  737  has  a  history  of  rudder  system-related  anomalies,  including  numerous 
instances  of  jamming.  Examples  of  jamming  events^^^  include  the  following: 

•  a  shotpeen  ball  lodged  in  a  servo  valve,  causing  the  rudder  to  move  full  right 
on  landing; 

•  shotpeen  balls  found  in  a  servo  valve  during  a  PCU  examination; 


See  section  1.18.1.1  for  more  details  about  these  events. 
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•  contamination  of  a  PCU  by  metal  particles,  causing  the  rudder  pedals  to  jam 
during  taxi; 

•  internal  PCU  contamination  and  worn  seals,  causing  the  rudder  to  lock  up  on 
approach; 

•  internal  PCU  corrosion  found  during  a  PCU  overhaul; 

•  a  loose  servo  valve  retaining  nut,  causing  rudder  binding  during  a  flight  check 
and  reduced  rates,  stall,  and  reversals  during  testing; 

•  corrosion  of  a  standby  rudder  PCU,  causing  full  left  rudder  deflection  during 
taxi; 

•  installation  of  an  incorrect  servo  valve  spring  guide,  allowing  for  rudder 
reversal  when  the  primary  slide  was  jammed  to  the  secondary  slide  and  a  rapid 
rudder  input  was  applied; 

•  fluid  contamination  of  a  yaw  damper  coupler,  causing  rapid  full  yaw  damper 
inputs  and  a  severe  oscillatory  roll; 

•  installation  of  an  incorrect  fastener  in  the  summing  lever  bearing,  resulting  in  a 
cracked  bearing  race;  and 

•  a  jammed  or  restricted  input  arm,  causing  full  rudder  to  move  to  its  full 
deflection. 

The  Safety  Board  is  concerned  that  the  new  features  of  the  redesigned  main  rudder 
PCU  do  not  address  all  of  these  malfunctions,  some  of  which  are  related  to  improper 
maintenance,  installation,  or  modification.  These  malfunctions  demonstrate  that  some 
jamming  conditions  resulted  in  a  loss  of  rudder  control.  Qther  jamming  conditions  were 
fortuitously  found  during  maintenance.  However,  because  the  main  and  standby  rudder 
actuators  receive  maintenance  only  “on  condition,”  possible  jamming  conditions  could 
exist  and  not  be  discovered  until  they  result  in  an  in-flight  failure. 

Further,  the  Safety  Board  is  concerned  that,  in  three  events  during  the  1980s, 
rudder  system  anomalies  occurred  in  flight  but  remained  unresolved  during  followup 
component  testing.  These  events,  two  reports  of  in-flight  “rudder  lockup”  (in  1982)  and  a 
rudder  “hardover  condition”  (in  1984),  indicated  that  potentially  serious  problems  could 
exist  and  cause  anomalous  behavior  without  leaving  evidence.  (These  events  were  first 
reported  to  the  Safety  Board  by  Parker  in  January  1999.)  It  is  significant  that  the  1984 
event  involved  a  PCU  that  produced  an  in-flight  hardover  condition  on  two  different 
aircraft  within  the  operator’s  fleet.  (According  to  Parker,  the  PCU  was  removed  and 
tested  after  the  first  upset  event.  When  no  fault  was  found,  the  PCU  was  installed  on 
another  aircraft  but  subsequently  failed  another  time.  Once  again,  no  fault  was  found 
during  followup  testing.) 

The  most  troubling  anomalies  are  those  that  could  result  in  reverse  rudder 
movement.  During  the  investigation  of  the  United  flight  585  accident,  many  technical 
experts  indicated  that  it  was  not  possible  to  jam  the  main  rudder  PCU  in  such  a  way  as  to 
generate  a  reversal  of  the  rudder  movement.  However,  since  that  time,  two  such  failure 
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modes  have  been  identified  in  the  original  servo  valve  design.  The  first  failure  mode  was 
discovered  in  tests  after  the  July  1992  main  rudder  PCU  jam  during  a  flight  control  ground 
check.  The  tests  demonstrated  that,  when  the  primary  slide  was  jammed  to  the  secondary 
slide,  a  jam/reversal  scenario  was  possible.  (The  servo  valve  was  subsequently  redesigned 
to  preclude  the  possibility  of  this  reversal  failure  mechanism.)  The  second  identified 
failure  mode  was  discovered  during  the  USAir  flight  427  accident  investigation.  Thermal 
tests  revealed  the  existence  of  a  jam/reversal  scenario  (which  prompted  another  redesign 
of  the  servo  valve  to  address  this  potential  reversal  failure  mechanism.)  The  Safety  Board 
notes  that  the  two  failure  modes  associated  with  reversal  were  identified  only  after  many 
years  of  737  operation  and  only  after  extensive  tests  and  examination  during  the 
investigation  of  the  United  flight  585  and  USAir  flight  427  catastrophic  accidents. 

The  difficulty  that  was  encountered  in  identifying  these  two  reversal  failure  modes 
is  not  surprising,  given  the  complexity  of  the  737  rudder  system.  The  entire  rudder  system 
assembly — the  standby  rudder  actuator,  main  rudder  PCU  servo  valve,  yaw  damper,  feel 
and  centering  mechanism,  rudder  trim  actuator,  torque  tube,  input  rods,  cranks,  links,  and 
summing  levers — is  an  extremely  complicated  design.  Further,  each  main  rudder  PCU 
servo  valve  must  be  individually  hand-finished  to  pass  the  manufacturer’s  acceptance  test 
procedures,  so  no  one  valve  is  exactly  the  same  as  another. 

In  addition  to  the  failure  modes  and  malfunctions  of  the  737  rudder  system  that 
have  already  been  identified,  the  Safety  Board  is  concerned  that  the  causes  of  certain  other 
reported  737  anomalies  remain  unresolved.  For  example,  the  Safety  Board  has  reviewed 
many  reports  of  737  pilots  feeling  “bumps”  on  the  rudder  pedals,  yet  in  several  cases  the 
cause  has  not  been  determined. 

The  Safety  Board’s  concerns  about  the  possibility  that  additional  failures  or 
malfunctions  may  result  in  uncommanded  rudder  motion  are  supported  by  the  early 
service  history  of  the  redesigned  servo  valve  currently  being  installed  in  the  737-NG  and 
retrofitted  in  all  other  737  series  airplanes.  For  example,  on  February  19,  1999,  an 
anomalous  rudder  response  was  noted  during  a  rudder  ground  check  in  Seattle  on  a  United 
Airlines  737  equipped  with  the  redesigned  servo  valve.  Both  the  flight  crew  and 
maintenance  personnel  found  that  greater  force  than  usual  was  necessary  to  move  the  right 
rudder  pedal.  Preliminary  investigative  findings  indicate  that  the  anomalous  rudder 
response  was  the  result  of  a  mispositioned  servo  valve  spring  guide.  Maintenance  records 
indicated  that,  71  flight  hours  earlier,  the  servo  valve  was  tested  for  indications  of  cracking 
of  the  secondary  slide.  (The  test  for  cracking  was  performed  twice  on  this  valve.  The 
PCU  passed  the  acceptance  test  procedure  after  the  first  test.  The  acceptance  test 
procedure  was  not  performed  after  the  second  test.) 

This  event  raises  concern  because  it  suggests  that  it  is  possible  to  successfully 
install  a  servo  valve  in  a  PCU  when  the  spring  guide  is  out  of  place.  Although  such  a 
mispositioning  would  have  been  detected  if  an  acceptance  test  procedure  had  been 
performed  after  the  second  cracking  test,  it  is  troubling  that  the  mispositioned  spring  guide 
was  not  detected  during  postmaintenance  systems  tests  after  the  PCU  was  reinstalled  on 
the  airplane.  Further,  the  mispositioned  spring  guide  was  not  detected  during  the 
numerous  flight  control  checks  and  flights  that  occurred  before  the  ground  check  during 
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which  the  anomalous  rudder  response  was  noted.  Another  troubling  scenario  is  the 
possibility  that  the  spring  guide  may  only  have  been  partially  mispositioned  at  the  time  the 
PCU  was  reinstalled  and  became  further  mispositioned  sometime  later  while  the  airplane 
was  oper^ing  in  service. 

A  second  incident  involving  the  redesigned  servo  valve  occurred  on  February  23, 
1999.  A  USAirways  Metrojet  737  apparently  experienced  an  unexplained  rudder 
hardover  in  flight.  The  flight  crew  regained  normal  rudder  control  only  after  it  activated 
the  standby  rudder  system,  as  prescribed  in  USAirways’  “Jammed  or  Restricted  Rudder” 
abnormal  procedure.  The  flight  crew  then  made  a  successful  emergency  landing  at 
Baltimore-Washington  International  Airport.  This  event  could  have  resulted  in  an 
unrecoverable  loss  of  control  if  it  had  occurred  at  a  lower  altitude  or  airspeed. 

Preliminary  results  of  kinematic  analysis  and  computer  simulations  of  the  Metrojet 
incident  using  FDR  data  indicate  that  the  rudder  traveled  slowly  to  its  blowdown  limit. 
Examination  of  the  rudder  system  (including  the  servo  valve)  to  date  has  found  no 
evidence  of  a  failure  or  Jam  either  in  the  servo  valve  or  outside  the  servo  valve  (such  as  a 
blockage  in  the  rudder  system  feedback  loop)  that  would  explain  an  uncommanded  rudder 
hardover. 

In  addition  to  its  concern  about  these  recent  in-service  events  involving  the 
redesigned  servo  valve,  the  Safety  Board  is  also  concerned  that  cracks  have  been  found  in 
the  secondary  slide  legs  of  several  of  the  redesigned  servo  valves  and  that  one  slide  was 
found  to  be  chipped.^^*  Boeing  indicated  that  metal  chips  liberated  from  a  crack  are  not 
likely  to  cause  uncommanded  rudder  motion.  However,  Boeing’s  conclusions  are  based 
on  preliminary  analyses  and  testing.  Little  is  known  about  the  initiation  or  progression  of 
the  cracking  or  the  migration  of  chips,  and  there  is  no  long-term  operational  experience 
with  the  redesigned  servo  valve  to  identify  with  certainty  how  this  cracking  is,  or  will  be, 
affected  by  in-service  conditions. 

The  Safety  Board  recognizes  that  737s  have  flown  for  over  92  million  flight  hours 
since  the  737-100  was  certificated  in  December  1967  and  that  the  airplane’s  accident  rate 
is  comparable  to  that  of  similar-type  airplanes.  Nonetheless,  the  Safety  Board  concludes 
that,  rudder  design  changes  to  737-NG  series  airplanes  and  the  changes  currently  being 
retrofitted  on  the  remainder  of  the  737  fleet  do  not  eliminate  the  possibility  of  other 
potential  failure  modes  and  malfunctions  in  the  737  rudder  system  that  could  lead  to  a  loss 
of  control. 

Redundancy  in  critical  flight  control  systems  is  a  basic  tenet  in  the  design  of 
commercial  transport  aircraft.  It  serves  to  reduce,  to  acceptably  low  levels,  the  probability 
of  catastrophic  outcomes  from  flight  control  malfunctions.  Redundancy  is  especially 
important  in  the  737  rudder  system  because  of  the  size  and  control  power  of  the  rudder 
(necessitated  by  the  twin  wing-mounted  engine  configuration  of  the  airplane). 


The  chipped  slide  was  found  on  a  servo  valve  awaiting  installation  on  an  Olympic  Airways  airplane. 
Boeing  stated  that  it  believed  the  chip  was  caused  by  a  rigging  tool  that  was  used  to  calibrate  the  servo  valve. 
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The  737  is  the  only  air  carrier  airplane  with  two  wing-mounted  engines  that  was 
designed  with  a  single-panel  rudder  controlled  by  a  single  actuator,  albeit  with  a  dual- 
concentric  servo  valve  design.  Other  rudder  system  designs  use  multiple  rudder  surfaces 
and/or  multiple  rudder  actuators.  For  example,  the  rudder  system  designs  of  the  Boeing 
757  and  767,  which  were  certificated  in  1982  (2  years  before  certification  of  the  737-300 
series),  use  three  actuators  and  do  not  rely  on  dual-concentric  servo  valves.  In  the  event  of 
a  jammed  or  failed  valve,  the  three-actuator  design  permits  the  failed  actuator  to  be 
immediately  overpowered,  or  “broken  out,”  by  pilot  input  using  the  other  two  actuators  so 
that  the  jammed  or  failed  PCU  no  longer  controls  the  movement  of  the  flight  control 
surface. 

Although  Boeing  has  indicated  that  three  actuators  were  incorporated  in  the  757 
and  767  design  to  allow  for  features  such  as  autopilot  control  of  the  rudder  during 
autolanding  and  removal  or  reduction  of  the  mass  used  to  balance  the  rudder,  the  multiple- 
actuator  design  clearly  provides  an  increased  level  of  safety.  Because  the  three  actuators 
are  fully  independent  (such  that  a  valve  jam  would  not  have  an  adverse  effect  on  another 
valve),  they  provide  true  redundancy  to  the  757  and  767  rudder  system.  It  is  noteworthy 
that  the  757  and  767  have  not  experienced  the  rudder-related  anomalies,  incidents,  or 
accidents  that  have  occurred  in  the  737  series. 

Although  dual-concentric  servo  valves  are  used  in  some  other  aircraft  control 
systems  for  activation  of  ailerons  or  elevators,  the  multiple  control  surfaces  and  breakout 
features  in  those  systems  were  designed  to  ensure  that  a  jam  of  one  control  surface  does 
not  affect  other  control  surfaces.  However,  these  redundant  systems  or  breakout  features 
do  not  exist  in  the  design  of  the  737  rudder  system. 

Further,  although  the  737  rudder  system  has  a  standby  rudder  PCU  that  is 
independent  of  the  main  rudder  PCU,  that  system  would  have  to  be  manually  activated  by 
the  flight  crew  in  the  event  of  a  servo  valve  jam.  If  a  jam  were  to  occur  close  to  the 
ground  or  result  in  an  unusual  attitude,  the  pilots  could  lose  control  of  the  airplane  before 
they  were  able  to  diagnose  the  problem  and  engage  the  standby  rudder.  Therefore, 
redundancy  in  the  current  737  rudder  system  is  limited  to  the  dual-concentric  design  of  the 
main  rudder  PCU  servo  valve  (and  the  dual  load  path  design  of  the  linkages  in  the  rudder 
system). 

The  October  7,  1993,  incident  involving  a  British  Airways  747-400,  G-BNLY, 
illustrates  the  need  for  greater  redundancy  in  flight  control  systems  that  include  a  dual- 
concentric  servo  valve.  Shortly  after  takeoff,  about  100  feet  above  ground  level,  the 
airplane’s  right  elevator  PCU  reversed  travel  when  a  hydraulic  pressure  surge,  resulting 
from  retraction  of  the  landing  gear,  caused  the  dual-concentric  servo  valve  secondary  slide 
to  overtravel  to  the  internal  retract  stop  and  the  primary  slide  to  move  to  the  limit  of  the 
extend  linkage  stop.  The  flight  crew  was  able  to  maintain  control  because  the  747 ’s 
elevators  are  operated  by  separate  PCUs  and  are  not  interconnected.  As  a  result,  the  flight 
crew  was  able  to  move  the  left-side  elevators  upward  to  counter  the  right-side  downward 
deflection.  Given  the  low  altitude  of  the  occurrence,  the  airplane  would  likely  have 
crashed  if  the  747’s  elevators  had  been  a  single-control  surface,  single-actuator  design. 
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The  Safety  Board’s  review  of  the  dual-concentric  servo  valve  design  indicates  that 
redundancy  is  compromised  in  the  existing  737  main  rudder  PCU  for  several  reasons. 
First,  no  method  may  exist  by  which  a  pilot  can  reliably  detect  the  presence  of  a  jammed 
primary  or  secondary  slide  within  the  main  rudder  PCU  servo  valve  that  drives  the 
actuator.^^^  Second,  the  dual-concentric  servo  valve  design  allows  for  failure  modes  in 
which  one  slide  can  directly  affect  the  operation  of  the  other  slide.  Third,  recent  design 
changes  do  not  eliminate  the  possibility  that  a  maintenance  error  (such  as  the  shotpeen 
balls  that  were  discovered  in  main  rudder  PCU  servo  valves)  could  result  in  a  servo  valve 
anomaly.  Last,  although  the  dual  load  path  is  structurally  redundant,  it  does  not  provide 
functional  redundancy.  The  mechanical  elements  of  the  main  rudder  PCU  external  to  the 
servo  valve  may  be  subject  to  jams  (such  as  blockage  between  the  input  crank  and  the 
external  body  stops),  possibly  leading  to  uncommanded  rudder  motion  that  the  dual- 
concentric  design  of  the  servo  valve  cannot  overcome.  These  failure  modes  markedly 
reduce  the  redundancy  that  was  intended  to  be  provided  by  the  dual-concentric  design  of 
the  servo  valve  and,  in  effect,  could  result  in  a  single-point  failure  in  the  737  rudder  PCU 
actuation  system.  Because  no  other  full-time  actuator  could  oppose  an  uncommanded 
rudder  motion,  an  airplane  operating  with  such  a  latent  failure  would  require  only  a  single 
additional  event,  such  as  a  rapid  rudder  input  or  an  additional  jam,  to  potentially  cause  a 
rudder  hardover. 

The  Safety  Board  considers  it  important  that,  if  a  failure/anomaly  were  to  occur 
within  a  critical  flight  control  system  (such  as  the  737  rudder  system),  the  transition  to  a 
backup  system  should  occur  automatically  and  immediately,  making  the  system  reliably 
redundant.  A  system  in  which  the  transition  to  a  backup  system  depends  on  the  pilots’ 
prompt  and  proper  perception  of  and  reaction  to  the  system  anomaly  is  not  reliably 
redundant.  Accordingly,  the  Safety  Board  concludes  that  the  dual-concentric  servo  valve 
used  in  all  737  main  rudder  PCUs  is  not  reliably  redundant. 

During  the  initial  certification  of  the  737-100  series,  FAA  certification  officials 
expressed  concern  about  the  airplane’s  single-panel,  single-actuator  rudder  system  and 
recognized  the  possibility  of  undetected  latent  failures  in  the  servo  valve,  thereby  negating 
the  system’s  redundancy.  The  rudder  system’s  history  of  service  difficulties  (some  of 
which  still  remain  unresolved),  particularly  the  servo  valve’s  history  of  jamming,  validates 
those  concerns. 

In  October  1996,  the  Safety  Board  issued  several  safety  recommendations  to 
improve  the  existing  737  rudder  system.  Specifically,  Safety  Recommendations 
A-96-107,  -109,  -112,  and  -113  asked  the  FAA  to 

Require  the  Boeing  Commercial  Airplane  Group,  working  with  other 
interested  parties,  to  develop  immediate  operational  measures  and  long¬ 
term  design  changes  for  the  737  series  airplane  to  preclude  the  potential  for 
loss  of  control  from  an  inadvertent  rudder  hardover.  Once  the  operational 


Although  the  Safety  Board  considers  it  critical  that  the  main  rudder  PCU  be  inspected  at  regular 
intervals,  such  inspections  do  not  guarantee  the  detection  of  latent  failures  within  the  main  rudder  system 
that  occur  between  inspections. 
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measures  and  design  changes  have  been  developed,  issue  respective 
airworthiness  directives  to  implement  these  actions.  (A-96-107) 

Require  the  Boeing  Commercial  Airplane  Group  to  develop  and  install  on 
all  new-production  737  airplanes  a  cockpit  indicator  system  that  indicates 
rudder  surface  position  and  movement.  For  existing  737  airplanes,  when 
implementing  the  installation  of  an  enhanced-parameter  flight  data 
recorder,  require  the  installation  of  a  cockpit  indicator  system  that  indicates 
rudder  surface  position  and  movement.  (A-96-109) 

Require  the  Boeing  Commercial  Airplane  Group  to  establish  appropriate 
inspection  intervals  and  a  service  life  limit  for  the  737  main  rudder  power 
control  unit.  (A-96-112) 

Require  the  Boeing  Commercial  Airplane  Group  to  devise  a  method  to 
detect  a  primary  or  a  secondary  jammed  slide  in  the  737  main  rudder  power 
control  unit  servo  valve  and  ensure  appropriate  communication  of  the 
information  to  mechanics  and  pilots.  (A-96-113) 

The  Safety  Board  is  disappointed  that  the  FAA  has  taken  no  action  to  establish 
inspection  intervals  or  a  service  life  limit  for  the  main  rudder  PCU  or  a  method  for 
detecting  and  annunciating  a  jammed  servo  valve  slide  to  flight  crews.  The  Board  is  also 
disappointed  that  the  FAA  has  stated  that  a  rudder  position  indicator  would  provide  no 
practical  information  to  the  pilots.  On  July  15, 1997,  Safety  Recommendations  A-96-107, 
-109,  -112,  and  -113  were  classified  “Open — Unacceptable  Response.”  (See  section 
1.18.11  for  a  full  discussion  of  the  FAA’s  actions  and  the  Safety  Board’s  comments  on 
those  actions.)  A  more  direct  and  fundamental  approach  to  correcting  the  deficiencies  in 
the  737  rudder  system  is  necessary. 

Because  of  the  complexity  of  the  737  rudder  system  (and  the  potential  for 
unforeseen  failure  mechanisms),  its  lack  of  redundancy  in  the  event  of  a  single-point 
failure  or  a  latent  failure,  and  the  continued  absence  of  cues  to  help  alert  flight  crews  to 
latent  failures,  the  Safety  Board  concludes  that  a  reliably  redundant  rudder  actuation 
system  is  needed  for  the  737,  despite  the  significant  improvements  that  have  been  made  in 
the  system’s  design.  Accordingly,  the  Safety  Board  believes  that  the  FAA  should  require 
that  all  existing  and  future  737s  have  a  reliably  redundant  rudder  actuation  system.  This 
redundancy  could  be  achieved  by  developing  a  multiple-panel  rudder  surface  or  providing 
multiple  actuators  for  a  single-panel  rudder  surface.  Further,  Safety  Recommendations 
A-96-107,  -109,  -112,  and  -113  are  classified  “Closed — ^Unacceptable  Action/ 
Superseded.” 

One  possible  way  of  incorporating  multiple  actuators  into  the  737  without 
extensive  structural  modification  would  be  to  modify  the  standby  rudder  system  so  that  its 
actuator  could  be  used  as  a  second  rudder  actuator.  Under  the  current  737  design,  the 
standby  rudder  actuator  powers  the  rudder  by  a  separate  hydraulic  system  that  activates 
manually  or  automatically  in  the  event  of  a  hydraulic  system  failure.  The  standby  rudder 
actuator  was  not  intended  to  be  used  as  a  full-time  actuator.  However,  design 
modifications  might  be  possible  to  make  the  standby  actuator  an  integral  part  of  the  main 
rudder  control  system.  Although  it  is  not  clear  whether  the  standby  rudder  system  could 
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be  modified  to  provide  a  truly  redundant  rudder  system  on  all  737  series  airplanes,  it  is 
possible  that  such  a  modification  might  provide  the  needed  redundancy. 

Another  possible  way  to  achieve  redundancy  in  the  rudder  control  system  would 
be  to  modify  it  so  that  the  standby  rudder  PCU  would  be  automatically  activated  and  the 
main  rudder  PCU  would  be  automatically  deactivated  if  the  main  rudder  PCU  actuator 
system  moves  the  rudder  without  a  pilot  command.  This  redundancy  could  be  achieved 
by  monitoring  the  rudder  position  and  comparing  this  position  with  the  one  being 
commanded  by  the  pilot  rudder  pedal  input.  Mismatches  between  the  two  positions  could 
then  trigger  a  logic  circuit  that  would  command  a  hydraulic  valve  unit  to  automatically 
shift  hydraulic  control  of  the  rudder  from  the  main  rudder  PCU  (that  is,  depressurize  its 
hydraulics)  to  the  standby  rudder  PCU.  This  action  would  allow  the  flight  crew  to  resume 
normal  control  of  the  rudder  using  the  standby  rudder  PCU.  (The  Safety  Board  recognizes 
that  additional  design  issues  must  be  considered  so  that  the  main  rudder  PCU  is  not 
deactivated  when  it  should  not  be.) 

Further,  to  gain  a  better  understanding  of  the  potential  failure  modes  in  the  737 
rudder  system,  the  Safety  Board  believes  that  the  FAA  should  convene  an  engineering  test 
and  evaluation  board  to  conduct  a  failure  analysis  to  identify  potential  failure  modes,  a 
component  and  subsystem  test  to  isolate  particular  failure  modes  found  during  the  failure 
analysis,  and  a  full-scale  integrated  systems  test  of  the  737  rudder  actuation  and  control 
system  to  identify  potential  latent  failures  and  validate  operation  of  the  system  without 
regard  to  minimum  certification  standards  and  requirements  in  14  CFR  Part  25. 
Participants  in  the  engineering  test  and  evaluation  board  should  include  the  FAA,  Safety 
Board  technical  advisors;  the  Boeing  Company;  other  appropriate  manufacturers;  and 
experts  from  other  government  agencies,  the  aviation  industry,  and  academia.  A  test  plan 
should  be  prepared  that  includes  installation  of  original  and  redesigned  737  main  rudder 
PCUs  and  related  equipment  and  exercises  all  potential  factors  that  could  initiate 
anomalous  behavior  (such  as  thermal  effects,  fluid  contamination,  maintenance  errors, 
mechanical  failure,  system  compliance,  and  structural  flexure).  The  engineering  board’s 
work  should  be  completed  by  March  31,  2000,  and  published  by  the  FAA. 

2.6.1  FAA  Certification  System 

In  light  of  the  safety  concerns  about  the  737  rudder  system  design,  the  Safety 
Board  is  concerned  about  the  FAA’s  regulatory  process  that  resulted  in  the  certification  of 
that  system.  The  Safety  Board  concludes  that,  on  the  basis  of  the  results  of  this 
investigation,  the  737  rudder  system  design  certificated  by  the  FAA  is  not  reliably 
redundant.  Therefore,  the  Safety  Board  believes  that  the  FAA  should  ensure  that  future 
transport-category  airplanes  certificated  by  the  FAA  provide  a  reliably  redundant  rudder 
actuation  system. 

The  Safety  Board  also  questions  the  FAA’s  interpretation  of  the  term  “normally 
encountered”  in  the  context  of  14  CFR  Section  25.671(c)(3).  Section  25.671(c)(3)  states 
the  following: 
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(c)  The  airplane  must  be  shown  by  analysis,  tests,  or  both,  to  be  capable  of 
continued  safe  flight  and  landing  after  any  of  the  following  failures  or 
jamming  in  the  flight  control  system  and  surfaces  (including  trim,  lift,  drag, 
and  feel  systems),  within  the  normal  flight  envelope,  without  requiring 
exceptional  piloting  skill  or  strength.  Probable  malfunctions  must  have 
only  minor  effects  on  control  system  operation  and  must  be  capable  of 
being  readily  counteracted  by  the  pilot. 

*  * 

(3)  Any  jam  in  a  control  position  normally  encountered  during  takeoff, 
climb,  cruise,  normal  turns,  descent,  and  landing  unless  the  jam  is  shown  to 
be  extremely  improbable,  or  can  be  alleviated.  A  runaway  of  a  flight 
control  to  an  adverse  position  and  jam  must  be  accounted  for  if  such 
runaway  and  subsequent  jamming  is  not  extremely  improbable. 

During  certification  of  the  737-NG  series  airplanes,  the  FAA  concluded  that  a 
normally  encountered  control  position  for  the  rudder  would  be  a  maximum  of  2.5°. 
However,  this  interpretation  seems  unrealistic  in  light  of  the  rudder’s  ability  to  travel  as 
much  as  26°  in  either  direction  and  its  criticality  in  countering  a  loss  of  engine  power  or 
crosswind  gust  on  takeoff  or  landing.  (It  is  unclear  how  a  different  interpretation  would 
have  affected  the  outcome  of  the  737-NG  certification  process.)  Such  a  narrow 
interpretation  may  well  reduce  the  level  of  protection  that  should  be  provided  by  a 
showing  of  compliance  with  this  rule.  Although  the  rudder  may  operate  for  much  of  the 
time  in  a  narrow  range,  a  jam  could  become  critical  during  those  times  when  deflections 
beyond  this  narrow  range  are  necessary. 

The  Safety  Board  questions  whether  it  is  appropriate  to  define  “normally 
encountered”  so  narrowly  and  even  whether  it  is  appropriate  to  include  that  phrase  in 
14CFR  Section  25.671.  The  Board  agrees  with  the  Critical  Design  Review  team’s 
position  on  this  issue.  The  team  stated  that  “if  a  control  position  is  possible,  it  is  there  for 
a  purpose,  and  the  pilot  can  use  that  control  authority.”  In  October  1996,  the  Safety  Board 
issued  Safety  Recommendation  A-96-108,  which  asked  the  FAA  to 

Revise  14  CFR  Section  25.671  to  account  for  the  failure  or  jamming  of  any 
flight  control  surface  at  its  design-limited  deflection.  Following  this 
revision,  reevaluate  all  transport-category  aireraft  and  ensure  compliance 
with  the  revised  criteria. 

In  response,  the  FAA  indicated  that  the  last  sentence  of  14  CFR  Section 
25.671(c)(3)  already  required  that  a  jam  of  a  flight  control  surface  at  its  design-limited 
deflection  be  accounted  for  unless  such  a  jam  is  extremely  improbable.  However,  the 
Safety  Board  is  concerned  that  the  rule  does  not  appear  to  require  any  analysis  of  failure  or 
jamming  of  flight  controls  in  positions  beyond  those  normally  encountered  but  short  of  a 
full  deflection.  For  example,  the  FAA’s  finding  that  the  737-NG  series  airplanes  complied 
with  this  rule  was  apparently  based  on  Boeing’s  assertion  that  rudder  position  jams  in  a 
normally  encountered  position  were  controllable  and  that  rate  jams  resulting  in  a  rudder 
hardover  were  extremely  improbable.  There  is  no  indication  that  Boeing  or  the  FAA 
considered  jams  in  any  intermediate  position. 
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The  Safety  Board  concludes  that  transport-category  airplanes  should  be  shown  to 
be  capable  of  continued  safe  flight  and  landing  after  a  jammed  flight  control  in  any 
position  unless  the  jam  can  be  shown  to  be  extremely  improbable.  Accordingly,  the 
Safety  Board  believes  that  the  FAA  should  amend  14  CFR  Section  25.671(c)(3)  to  require 
that  transport-category  airplanes  be  shown  to  be  capable  of  continued  safe  flight  and 
landing  after  jamming  of  a  flight  control  at  any  deflection  possible,  up  to  and  including  its 
full  deflection,  unless  such  a  jam  is  shown  to  be  extremely  improbable.  Because  the 
Safety  Board  recognizes  that  the  language  of  Safety  Recommendation  A-96-108  may  not 
have  adequately  expressed  this  concern,  that  recommendation  is  classified  “Closed — 
Reconsi  dered/Superseded.  ” 

2.7  Flight  Crew  Procedures  and  Training 
2.7.1  Unusual  Attitude  Training  for  Air  Carrier  Piiots 

Before  the  USAir  flight  427  accident,  the  Safety  Board  had  issued  a  series  of 
safety  recommendations  over  a  24-year  period,  asking  the  FAA  to  require  air  carriers  to 
train  pilots  in  recoveries  from  unusual  flight  attitudes.  Throughout  this  period,  the  Safety 
Board  was  generally  not  satisfied  with  the  FAA’s  responses  to  these  recommendations; 
specifically,  the  Board  disagreed  with  the  FAA’s  responses  that  cited  the  inadequacy  of 
flight  simulators  as  a  reason  for  not  providing  pilots  with  the  requested  training.  However, 
after  the  USAir  flight  427  accident  and  the  October  31,  1994,  ATR-72  accident  involving 
Simmons  Airlines  flight  4184  near  Roselawn,  Indiana,^^®  the  FAA  issued  guidance  to  air 
carriers,  acknowledging  the  value  of  flight  simulator  training  in  unusual  attitude 
recoveries  and  encouraging  air  carriers  to  voluntarily  provide  this  training  to  their  pilots. 
The  voluntary  training  programs  that  were  implemented  by  many  air  carriers  (including 
USAir)  have  been  excellent.  In  October  1996,  the  Safety  Board  issued  Safety 
Recommendation  A-96-120,  asking  the  FAA  to 

Require  14  CFR  Part  121  and  135  operators  to  provide  training  to  flight 
crews  in  the  recognition  of  and  recovery  from  unusual  attitudes  and  upset 
maneuvers,  including  upsets  that  occur  while  the  aircraft  is  being 
controlled  by  automatic  flight  control  systems,  and  unusual  attitudes  that 
result  from  flight  control  malfunctions  and  uncommanded  flight  control 
surface  movements. 

The  Safety  Board’s  concerns  about  the  role  of  automatic  flight  control  systems  in 
unusual  attitude  situations  were  validated  when  Comair  flight  3272,  an  Embraer  120RT, 
crashed  on  January  9, 1997,  near  Monroe,  Michigan.  The  investigation  determined  that  an 
engaged  autopilot  masked  the  most  salient  cues  to  the  flight  crew  of  a  developing 
uncommanded  rolling  moment.^^^  Similarly,  the  challenge  posed  to  pilots  by  flight 


For  more  information  on  this  accident,  see  the  discussion  of  Safety  Recommendation  A-96-120  in 
section  1.18.11.5. 

National  Transportation  Safety  Board.  1998.  In-Flight  Icing  Encounter  and  Uncontrolled  Collision 
with  Terrain,  Comair  Flight  3272,  Embraer  EMB-I20RT,  N265CA,  Monroe,  Michigan,  January  9,  1997. 
Aircraft  Accident  Report  NTSB/ AAR-98/04.  Washington,  DC. 
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control  malfunctions  was  demonstrated  by  the  circumstances  of  the  accidents  involving 
USAir  flight  427  and  United  flight  585,  the  incident  involving  Eastwind  Airlines 
flight  517  (which  involved  uncommanded  rudder  movement),  and  the  accident  involving 
Simmons  Airlines  flight  4184  (which  involved  uncommanded  aileron  movement). 

The  Safety  Board  recognizes  the  value  of  air  carrier  voluntary  unusual  attitude 
training  programs.  However,  all  air  carriers  may  not  be  implementing  such  a  program. 
Further,  the  FAA  has  not  addressed  flight  control  malfunctions  (such  as  uncommanded 
rudder  surface  movements)  in  its  guidance  material  for  air  carrier  unusual  attitude  training 
programs.  In  addition,  the  unusual  attitude  training  tool  developed  in  1998  by  industry, 
labor  unions,  and  the  FAA  does  not  include  guidance  on  flight  control  malfunctions. 

In  January  1997,  the  FAA  informed  the  Safety  Board  that  it  was  considering 
issuance  of  a  notice  of  proposed  rulemaking  (NPRM)  to  require  air  carriers  to  conduct 
unusual  attitude  training.  However,  as  of  March  1999,  the  FAA  had  not  issued  the  NPRM. 
The  FAA  indicated,  in  informal  correspondence  with  the  Safety  Board,  that  it  might 
include  an  unusual  attitude  training  requirement  as  part  of  a  planned  general  revision  to 
the  regulations  governing  air  carrier  pilot  training  (14  CFR  Part  121,  Subparts  N  and  O). 

The  Safety  Board  is  concerned  that  the  FAA  has  not  yet  taken  the  necessary 
regulatory  action  to  require  unusual  attitude  training  for  air  carrier  pilots.  The  Board  is 
also  concerned  that  the  guidance  and  programs  developed  to  date  do  not  include  scenarios 
involving  flight  control  malfunctions.  Accordingly,  because  of  the  lack  of  progress 
toward  requiring  for  air  carrier  pilots  unusual  attitude  training  that  addresses  flight  control 
malfunctions,  such  as  uncommanded  flight  control  surface  movements.  Safety 
Recommendation  is  classified  A-96-120  “Open — ^Unacceptable  Response.”  The  Safety 
Board  urges  the  FAA  to  take  expeditious  action  to  require  such  unusual  attitude  training. 

2.7.2  Unusual  Attitude  Training  for  Boeing  737  Pilots 

At  the  time  of  the  USAir  flight  427  accident,  no  air  carrier  training  programs  were 
specifically  aimed  at  training  737  pilots  to  recognize  and  address  a  rudder  jam  or  reversal. 
The  guidance  available  at  that  time  from  Boeing  advised  pilots,  as  a  first  consideration,  to 
maintain  or  regain  full  control  of  the  airplane.  Specifically,  the  guidance  advised  pilots  to 
counter  unwanted  roll  tendencies  from  a  malfunctioning  rudder  with  the  application  of  up 
to  full  aileron  control  inputs.  However,  the  guidance  did  not  advise  pilots  that,  at  some 
airspeeds,  an  uncommanded  full  rudder  input  could  not  be  successfully  opposed  by  full 
wheel  (aileron  and  spoiler)  inputs  and  that  a  reduction  in  the  airplane’s  angle-of-attack 
could  improve  the  effectiveness  of  the  roll  controls  relative  to  the  effectiveness  of  the 
rudder.  Boeing’s  guidance  for  relieving  a  jammed  rudder  informed  pilots  only  that  they 
should  use  maximum  force  to  overpower  the  jam  and  specifically  warned  pilots  against 
turning  off  flight  control  switches  “unless  the  faulty  control  was  positively  identified.” 


According  to  the  FAA’s  January  13,  1999,  letter  to  the  Safety  Board’s  Director  of  the  Office  of 
Aviation  Safety,  at  least  13  U.S.-based  air  carriers  (including  USAir)  had  implemented  special  events 
training  (SET)  programs  by  mid-1996.  The  letter  indicated  that  “other  carriers... as  well  as  training  center 
operators... were  initiating  SET  programs.” 
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No  additional  guidance  was  provided  about  the  effects  of  flight  control  switch  selections 
on  rudder  jam  conditions. 

The  Safety  Board  recognizes  that,  even  if  unusual  attitude  training  specifically 
targeted  at  the  rudder  reversal  situation  were  provided  to  pilots  on  a  recurrent  basis,  a 
rudder  reversal  is  such  a  confusing  and  distracting  event  that  no  training  could  completely 
prepare  pilots  to  diagnose  and  respond  to  (in  the  few  seconds  that  would  be  available)  a 
rudder  reversal  that  occurred  without  warning.  Consequently,  the  Safety  Board  cannot  be 
certain  that  the  pilots  of  USAir  flight  427  would  have  recovered  control  of  the  airplane  if 
they  had  received  such  training.  However,  the  Safety  Board  concludes  that  pilots  would 
be  more  likely  to  recover  successfully  from  an  uncommanded  rudder  reversal  if  they  were 
provided  the  necessary  knowledge,  procedures,  and  training  to  counter  such  an  event. 

In  December  1996,  the  FAA  issued  AD  96-26-07,  requiring  that  the  737  Airplane 
Flight  Manual  be  revised  to  include  procedures  for  maintaining  control  of  an  airplane 
during  an  uncommanded  yaw  or  roll  or  a  jammed  or  restricted  rudder  condition.  In 
response  to  this  AD,  Boeing  established  procedures  in  February  1997  to  provide  an 
effective  means  of  regaining  control  of  the  airplane  under  most  (but  not  all)  flight 
conditions.^*'  The  “Uncommanded  Yaw  or  Roll”  procedure  establishes  the  actions  to  be 
performed  by  pilots  immediately,  from  memory,  to  halt  the  uncommanded  motion  of  the 
airplane.  The  “Jammed  or  Restricted  Rudder”  procedure  establishes  a  means  of  handling 
a  variety  of  rudder  malfunctions  (including  rudder  reversal)  in  a  systematic  manner. 
These  procedures  were  subsequently  added  to  Boeing’s  737  Operations  Manual  and 
adopted  by  U.S.  air  carriers. 

The  Safety  Board  recognizes  that  the  hydraulic  pressure  reducer  that  is  being 
retrofitted  on  earlier  series  737  models,  and  the  hydraulic  pressure  limiter  being  installed 
in  the  NG  models,  should  provide  737  flight  crews  with  a  greater  margin  of  controllability 
and  additional  response  time  for  executing  these  required  procedures.  However,  the 
ability  to  recover  from  an  uncommanded  yaw  or  roll  or  a  jammed  or  restricted  rudder 
(including  a  rudder  reversal),  within  the  time  that  would  be  available,  requires  training  and 
practice  in  executing  the  specific  procedures.  In  October  1996,  the  Safety  Board  issued 
Safety  Recommendation  A-96-1 1 8,  asking  the  FAA  to 

Require  the  Boeing  Commercial  Airplane  Group,  working  with  other 
interested  parties,  to  develop  procedures  that  require  737  flight  crews  to 
disengage  the  yaw  damper  in  the  event  of  an  uncommanded  yaw  upset  as  a 
memorized  or  learned  action.  Once  the  procedures  are  developed,  require 
operators  to  implement  these  procedures. 

The  Safety  Board  had  been  concerned  that  the  procedures  described  in 
AD  96-26-07  did  not  include  disengagement  of  the  yaw  damper  as  an  action  to  be 
performed  immediately  from  memory.  The  Board’s  concern  was  based  on  the  relatively 


During  the  comment  period  for  AD  96-26-07,  the  Safety  Board  expressed  its  concerns  to  the  FAA 
that  these  procedures  might  not  be  adequate  if  a  rudder  reversal  were  to  occur  at  a  low  altitude,  especially 
with  an  engine  failure  during  takeoff.  See  section  2.5  for  a  discussion  of  the  flight  regimes  in  which  flight 
crew  action  could  not  prevent  an  accident  in  the  event  of  a  rudder  jam/reversal  malfunction. 
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frequent  occurrence  (compared  with  other  rudder  system  malfunctions)  of  yaw  damper 
malfunctions  in  the  737,  which  might  lead  pilots  to  unnecessarily  perform  the  actions  in 
the  “Jammed  or  Restricted  Rudder”  procedure.  The  Safety  Board’s  review  of  the 
February  1997  changes  to  Boeing’s  737  Operations  Manual,  and  air  carriers’  adoption  of 
those  provisions,  indicate  that  U.S.  air  carriers  are  currently  providing  flight  crews  with  an 
immediate  action  procedure  that  should  effectively  handle  yaw  damper  system 
malfunctions.  Therefore,  Safety  Recommendation  A-96-118  is  classified  “Closed — 
Acceptable  Action.” 

The  Safety  Board  is  concerned  that  the  “Jammed  or  Restricted  Rudder”  procedure 
established  a  pilot’s  ability  to  “center”  the  rudder  pedals  (that  is,  achieve  a  neutral  rudder 
pedal  position)  as  the  criterion  for  successful  resolution  of  a  rudder  malfunction. 
Specifically,  the  Board  is  concerned  that,  in  a  rudder  reversal  situation,  compliance  in  the 
rudder  system  could  allow  the  rudder  pedals  to  reach  the  neutral  position  while  the  rudder 
surface  remains  deflected  to  the  blowdown  limit.  As  a  result,  the  Safety  Board  concludes 
that  a  neutral  rudder  pedal  position  is  not  a  valid  indicator  that  a  rudder  reversal  in  the  737 
has  been  relieved.  Therefore,  the  Safety  Board  believes  that  the  FAA  should  revise 
AD  96-26-07  so  that  procedures  for  addressing  a  jammed  or  restricted  rudder  do  not  rely 
on  the  pilots’  ability  to  center  the  rudder  pedals  as  an  indication  that  the  rudder 
malfunction  has  been  successfully  resolved,  and  require  Boeing  and  U.S.  operators  of 
737s  to  amend  their  Airplane  Flight  Manuals  and  Operations  Manuals  accordingly. 

Although  the  procedures  specified  by  AD  96-26-07  did  not  establish  a  requirement 
for  air  carriers  to  provide  training  to  flight  crews.  Flight  Standards  Information  Bulletin 
(FSIB)  98-03,  issued  in  January  1998,  directed  the  FAA’s  principal  operations  inspectors 
to  require  air  carriers  to  “amend  their  training  programs  to  provide  initial  and  recurrent 
training  in  the  recognition  of  and  recovery  from  unusual  attitudes  and  upsets  caused  by 
reverse  rudder  response.”  However,  neither  AD  96-26-07  nor  FSIB  98-03  provided 
specific  guidance  on  how  training  for  these  procedures  was  to  be  accomplished.  In  its 
comments  on  the  NPRM  for  AD  96-26-07,  the  Safety  Board  expressed  its  concerns  that 
737  pilots  needed  to  be  explicitly  trained  on  a  regular  basis  in  the  execution  of  the  new 
procedures.  In  February  1997,  the  Safety  Board  issued  Safety  Recommendation  A-97-18, 
asking  the  FAA  to 

Require  the  Boeing  Commercial  Airplane  Group  to  develop  operational 
procedures  for  737  flight  crews  that  effectively  deal  with  a  sudden 
uncommanded  movement  of  the  rudder  to  the  limit  of  its  travel  for  any 
given  flight  condition  in  the  airplane’s  operational  envelope,  including 
specific  initial  and  periodic  training  in  the  recognition  of  and  recovery 
from  unusual  attitudes  and  upsets  caused  by  reverse  rudder  response.  Once 
the  procedures  are  developed,  require  737  operators  to  provide  this  training 
to  their  pilots. 

Although  the  new  procedures  are  well  documented  in  FAA,  Boeing,  and  air  carrier 
publications,  3  of  12  U.S.  air  carrier  operators  of  the  737  contacted  by  the  Safety  Board  in 
July  1998  were  not  providing  any  simulator  training  to  their  pilots  on  these  procedures. 
(These  3  air  carriers  accounted  for  about  20  percent  of  the  1,070  total  737  airplanes 
operated  by  the  12  air  carriers).  Further,  of  the  nine  air  carriers  that  were  providing  such 
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training,  only  five  had  specified  in  their  training  manuals  that  the  procedures  should  be 
performed  by  students  during  simulator  training  at  least  to  the  point  of  selecting  the 
hydraulic  system  B  flight  control  switch  to  the  standby  rudder  position.  (These  5  air 
carriers  accounted  for  about  40  percent  of  the  total  737  airplanes  operated  by  the  air 
carriers.)  Thus,  pilots  for  more  than  one-half  of  U.S.  air  carrier  operators  of  the  737 
airplanes  (7  of  the  12  air  carriers  included  in  the  Board’s  survey)  were  not  being  provided 
the  opportunity  to  practice  the  responses  to  a  jammed  or  restricted  rudder  (including  a 
rudder  reversal)  that  might  be  most  effective  in  relieving  or  overcoming  the  effects  of  a 
jammed  main  rudder  PCU  servo  valve. 

Further,  although  Boeing  has  published  and  disseminated  information  about  the 
crossover  airspeed  phenomenon,^*^  only  one-half  of  the  12  air  carriers  contacted  by  the 
Safety  Board  in  July  1998  were  providing  737  flight  crews  with  a  demonstration  of 
crossover  airspeed  in  a  flight  simulator.  Moreover,  the  training  materials  for  only  one- 
third  of  the  12  air  carriers  (accounting  for  about  72  percent  of  the  737  airplanes)  required  a 
demonstration  of  the  crossover  airspeed  to  pilots  in  the  flaps  1  configuration  (in  which  the 
airplane  can  reach  the  crossover  airspeed  before  the  1  G  stickshaker  speed).  Thus,  pilots 
for  as  many  as  two-thirds  of  the  U.S.  air  carrier  operators  of  the  737  were  not  being 
provided  experience  that  demonstrated  the  inability  to  control  the  airplane  at  some  speeds 
and  configurations  by  using  only  the  roll  controls  during  a  rudder  hardover  condition.  The 
Safety  Board  is  also  concerned  that  flight  tests  conducted  as  part  of  the  USAir  flight  427 
investigation  showed  that  the  simulator  package  developed  by  Boeing  and  implemented  in 
the  air  carriers’  training  simulators  did  not  adequately  simulate  the  crossover  airspeed 
phenomenon.  In  addition,  the  Safety  Board  is  concerned  that  Boeing  has  not  updated  its 
existing  simulator  package,  even  though  the  data  needed  to  do  so  is  readily  available  as  a 
result  of  these  flight  tests. 

The  Safety  Board  concludes  that  the  training  being  provided  to  many  737  flight 
crews  on  the  procedures  for  recovering  from  a  jammed  or  restricted  rudder  (including  a 
rudder  reversal)  is  inadequate.  Therefore,  the  Safety  Board  believes  that  the  FAA  should 
require  all  14  CFR  Part  121  air  carrier  operators  of  the  737  to  provide  their  flight  crews 
with  initial  and  recurrent  flight  simulator  training  in  the  “Uncommanded  Yaw  or  Roll”  and 
“Jammed  or  Restricted  Rudder”  procedures  in  Boeing’s  737  Operations  Manual.  The 
training  should  demonstrate  the  inability  to  control  the  airplane  at  some  speeds  and 
configurations  by  using  the  roll  controls  (the  crossover  airspeed  phenomenon)  and  include 
performance  of  both  procedures  in  their  entirety.  Because  of  this  new  safety 
recommendation  and  the  FAA’s  failure  to  fully  address  Safety  Recommendation  A-97-18, 
the  earlier  recommendation  is  classified  “Closed — Unacceptable  Response/Superceded.” 
In  addition,  the  Safety  Board  believes  that  the  FAA  should  require  Boeing  to  update  its 
737  simulator  package  to  reflect  flight  test  data  on  crossover  airspeed  and  then  require  all 
operators  of  the  737  to  incorporate  these  changes  in  their  simulators  used  for  737  pilot 
training. 


Boeing  discussed  crossover  airspeed  extensively  in  the  July  1997  Flight  Operations  Review  article 
entitled  “737  Directional  Control.”  (See  section  1.18.10.2.3.) 


Analysis 


288 


Aircraft  Accident  Report 


Finally,  the  Safety  Board  is  extremely  concerned  that,  more  than  4  years  after  the 
USAir  flight  427  accident,  two  smaller  U.S.  737  operators  (accounting  for  16  of  the  1,070 
total  737  airplanes  operated  by  the  12  air  carriers)  were  continuing  to  use  minimum 
maneuvering  speed  schedules  that  permit  operation  of  the  737  in  the  flaps  1  configuration 
at  airspeeds  (158  and  164  knots)  that  are  as  much  as  30  knots  slower  than  the  1  G 
crossover  airspeed.  (The  FAA  had  accepted  the  use  of  these  minimum  maneuvering  speed 
schedules.)  In  addition,  the  Board  is  concerned  that  the  Boeing-recommended  block 
maneuvering  speeds  schedule  specifies  190  knots,  which  only  slightly  exceeds  the  1  G 
crossover  airspeed,  as  the  minimum  speed  for  a  737  operating  at  a  gross  weight  of  110,000 
pounds  in  the  flaps  1  configuration.  Only  one-third  of  the  12  U.S.  737  air  carrier  operators 
contacted  by  the  Safety  Board  in  July  1998  (accounting  for  66  percent  of  the  737 
airplanes)  actively  promoted  the  practice  of  adding  10  knots  to  the  737  block  maneuvering 
speeds  (for  which  Boeing  has  expressed  neither  support  nor  disapproval). 

The  Safety  Board  concludes  that  the  continued  use  by  air  carriers  of  airspeeds 
below  the  existing  block  maneuvering  speed  schedule  presents  an  unacceptable  hazard 
and  that  the  existing  block  maneuvering  speed  for  the  flaps  1  configuration  provides  an 
inadequate  margin  of  controllability  in  the  event  of  a  rudder  hardover.  Therefore,  the 
Safety  Board  believes  that  the  FAA  should  evaluate  the  737’s  block  maneuvering  speed 
schedule  to  ensure  the  adequacy  of  airspeed  margins  above  crossover  airspeed  for  each 
flap  configuration,  provide  the  results  of  the  evaluation  to  air  carrier  operators  of  the  737 
and  the  Safety  Board,  and  require  Boeing  to  revise  block  maneuvering  speeds  to  ensure  a 
safe  airspeed  margin  above  crossover  airspeed. 

2.8  Flight  Data  Recorder  Capabilities 

The  airplanes  involved  in  the  United  flight  585  and  USAir  flight  427  accidents 
were  required  by  existing  regulations  (14  CFR  Section  121.343)  to  have  FDRs  that 
recorded  5  and  11  parameters,  respectively. If  these  airplanes  had  been  equipped  with 
FDRs  with  additional  parameters,  that  information  would  have  undoubtedly  allowed  quick 
identification  of  critical  control  surface  movements  and  their  sources  and  other  airplane 
system  conditions  that  could  have  been  involved  in  the  loss  of  airplane  control.  Thus, 
investigators  would  have  been  able  to  more  quickly  rule  out  certain  factors,  when 
warranted,  and  focus  on  other  areas. 

The  Safety  Board  has  addressed  the  importance  of  improving  the  quality  and 
amount  of  data  recorded  by  FDRs  in  several  recent  aviation  accident  reports  and  safety 
recommendations.  In  February  1995,  the  Safety  Board  issued  urgent  Safety 
Recommendation  A-95-25,  urging  the  FAA  to 

Require  that  each  Boeing  737  airplane  operated  under  14  CFR  Parts  121  or 

125  be  equipped,  by  December  31,  1995,  with  a  flight  data  recorder  system 

that  records,  at  a  minimum,  the  parameters  required  by  current  regulations 


As  previously  discussed  (see  section  1.11.2),  although  existing  regulations  required  the  FDR  that 
was  installed  on  the  USAir  flight  427  airplane  to  record  11  parameters,  the  accident  airplane’s  FDR  recorded 
13  parameters. 
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applicable  to  that  airplane  plus  the  following  parameters  (recorded  at  the 
sampling  rates  specified  in  "Proposed  Minimum  FDR  Parameter 
Requirements  for  Airplanes  in  Service”):  lateral  acceleration;  flight  control 
inputs  for  pitch,  roll,  and  yaw;  and  primary  flight  control  surface  positions 
for  pitch,  roll,  and  yaw.^^'* 

The  FAA  indicated  that  it  agreed  with  the  intent  of  the  Safety  Board’s 
recommendation.  However,  the  FAA  did  not  meet  the  recommendation’s  proposed 
December  31, 1995,  retrofit  completion  date,  characterizing  it  as  “an  extremely  aggressive 
schedule.”  The  Safety  Board  repeatedly  expressed  its  disappointment  with  the  FAA’s  lack 
of  action  and  urged  the  FAA  to  act  promptly  because  of  the  criticality  of  the  issue  and  the 
persisting  reports  of  unexplained  737  in-flight  disturbances. 

More  than  1  year  after  the  FAA’s  response  to  Safety  Recommendation  A-95-25 
(and  almost  6  months  after  the  recommended  December  31,  1995,  FDR  retrofit 
completion  date),  the  Eastwind  flight  517  incident  occurred.  The  Safety  Board’s  July  1, 
1996,  letter  to  the  FAA  indicated  the  Board’s  belief  that  the  Eastwind  incident  could  have 
become  the  third  fatal  737  upset  accident  for  which  inadequate  FDR  information  would 
have  hampered  an  investigation.  Because  the  FAA  had  not  acted  in  the  time  frame 
proposed  by  the  Safety  Board  in  its  urgent  safety  recommendation,  the  FDR  recordings 
from  the  Eastwind  incident  airplane  did  not  provide  sufficient  data  to  identify  rudder 
surface  and  rudder  pedal  movements.  If  this  information  had  been  available,  investigators 
would  have  been  better  able  to  understand  the  Eastwind  incident  and,  more  importantly, 
would  likely  have  gained  significant  additional  insight  into  previous  upset  events,  such  as 
the  USAir  flight  427  and  United  flight  585  accidents.  In  1996,  Safety  Recommendation 
A-95-25  was  placed  on  the  Safety  Board’s  list  of  Most  Wanted  Safety  Improvements. 

In  its  July  9,  1997,  final  rule,  the  FAA  required  that  new  and  existing  transport- 
category  airplanes  “be  equipped  to  record  the  parameters  recommended  by  the  Board” 
with  final  compliance  required  by  August  19,  2002.  Although  the  Safety  Board 
considered  the  FAA’s  action  a  major  improvement  over  the  former  FDR  requirements,  the 
Board  disagreed  that  the  FAA’s  requirements  for  retrofitting  existing  airplanes  included  all 
parameters  recommended  by  the  Board  in  its  urgent  safety  recommendation. Further, 
the  Safety  Board  was  disappointed  with  the  extended  time  frame  and  incremental 
increases  allowed  for  compliance  with  the  new  FDR  requirements,  especially  for  737 
airplanes. 

In  its  July  22,  1997,  letter  to  the  Safety  Board,  the  FAA  stated  that  the  retrofit 
modification  should  be  accomplished  “at  the  earliest  practicable  time”  but  no  later  than 
the  next  heavy  maintenance  check  after  August  18,  1999.  During  the  Safety  Board’s 
investigation  of  the  February  23,  1999,  Metrojet  upset  event,  the  Board  learned  that  the 
incident  airplane  was  scheduled  for  a  heavy  maintenance  check  in  March  1999  but  was 


^  See  section  1.18.11.4  for  more  information  on  previous  FDR  safety  recommendations. 

The  Safety  Board  recommended  (but  the  FAA  did  not  require)  that  airplanes  manufactured  before 
1991  record  data  for  the  following  parameters:  pitch  trim;  thrust  reverser  position;  flaps,  leading  edge  slats, 
and  ground  spoiler  positions;  angle-of-attack;  and  outside  and  total  air  temperatures. 
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not  scheduled  to  receive  the  required  FDR  upgrade  until  its  heavy  maintenance  check  in 
March  2001.  Therefore,  the  Safety  Board  is  concerned  that  some  air  carriers  may  have 
disregarded  the  directive  to  accomplish  the  upgrade  at  the  earliest  practicable  time  and 
may  have  interpreted  the  rule  to  require  no  action  until  after  August  18,  1999.  However, 
the  Safety  Board  notes  that  at  least  one  U.S.  737  operator  (Southwest  Airlines)  has 
aggressively  pursued  the  FDR  upgrade  within  its  fleet  and  anticipates  having  all  its 
airplanes’  FDRs  upgraded  by  December  1999  (about  F/2  years  before  the  modification 
completion  date  mandated  by  the  FA  A). 

As  previously  discussed,  several  737  rudder-related  events  have  been  associated 
with  the  yaw  damper  system,  which  moves  the  rudder  without  any  corresponding 
movement  of  the  flight  crew’s  rudder  pedals.  To  adequately  monitor  this  system,  FDRs 
would  have  to  record  several  parameters  that  are  not  required  by  the  FAA’s  July  1997  final 
rule  regarding  upgraded  FDRs.  By  documenting  the  yaw  damper’s  operation  (command 
voltage  to  the  rudder  and  on/off  discrete  indication)  and  the  resultant  rudder  surface 
movement,  a  yaw  damper  event  could  quickly  be  distinguished  from  a  flight  crew  input  or 
a  rudder  anomaly. 

Additionally,  upgraded  FDRs  are  expected  to  record  the  pilots’  flight  control 
inputs  and  the  flight  control  surface  movements.  However,  the  FAA  is  not  requiring  the 
FDRs  on  existing  airplanes,  including  737s,^^^  and  those  manufactured  before  August 
2002  to  be  upgraded  to  record  the  pilots’  flight  control  input  forces.  The  Safety  Board 
considers  documentation  of  pilot  flight  control  input  forces  to  be  critical  in  determining 
the  pilots’  role  in  a  flight  control-related  event  and  notes  that  such  documentation  appears 
especially  critical  in  the  case  of  the  737.  If  pilot  flight  control  input  forces  had  been 
recorded  for  the  USAir  flight  427,  United  flight  585,  and  Eastwind  flight  517  airplanes, 
these  investigations  would  have  been  resolved  more  promptly,  and  actions  to  prevent 
future  similar  events  would  have  been  hastened. 

Parameters  such  as  pitch  trim,  thrust  reverser  position,  and  leading  and  trailing 
edge  flap  positions  would  also  provide  potentially  valuable  information  to  accident 
investigators.  The  Safety  Board  issued  Safety  Recommendations  A-95-26  and  A-95-27  in 
February  1995,  stating  that  FDRs  installed  on  all  airplanes  operated  under  14  CFR  Parts 
121,  125,  or  135  should  be  upgraded  to  record  these  parameters.  Although  such  an 
upgrade  would  be  easily  accomplished  on  airplanes  equipped  with  flight  data  acquisition 
units  (FDAU),  the  FAA,  to  date,  has  not  required  that  affected  airplanes  be  upgraded 
accordingly. 

The  Safety  Board  concludes  that  the  FDR  upgrade  modifications  required  by  the 
FAA  for  existing  airplanes  are  inadequate  because  they  do  not  require  the  FDR  to  be 
modified  to  record  yaw  damper  command  voltage;  yaw  damper  and  standby  rudder  on/off 


^  Title  14  CFR  Section  25.1459(e)  states  that  “any  novel  or  unique  design  or  operational 
characteristics  of  the  aircraft  shall  be  evaluated  to  determine  if  any  dedicated  parameters  must  be  recorded 
on  flight  recorders  in  addition  to  or  in  place  of  existing  requirements.”  The  Safety  Board  notes  that  the  737  s 
unique  rudder  actuation  system  design  and  rudder  system  service  history  justify  the  recording  of  additional 
parameters  on  737  FDRs. 
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discrete  indications;  pitch  trim;  thrust  reverser  position;  leading  and  trailing  edge  flap 
positions;  and  pilot  flight  control  input  forces  for  control  wheel,  control  column,  and 
rudder  pedals.  Further,  the  Safety  Board  concludes  that,  on  the  basis  of  the  rudder-related 
anomalies  discussed  in  this  report,  FDR  documentation  of  yaw  damper  command  voltage; 
yaw  damper  and  standby  rudder  on/off  discrete  indications;  and  pilot  flight  control  input 
forces  for  control  wheel,  control  column,  and  rudder  pedals  is  especially  important  in  the 
case  of  the  737,  and  these  parameters  should  be  sampled  on  737  airplanes  at  frequent 
intervals  to  provide  optimal  documentation. 

Therefore,  the  Safety  Board  believes  that  the  FAA  should  require  that  all  737 
airplanes  operated  under  14  CFR  Parts  121  or  125  that  currently  have  a  FDAU  be 
equipped,  by  July  31,  2000,  with  an  FDR  system  that  records,  at  a  minimum,  the 
parameters  required  by  FAA  Final  Rules  121.344  and  125.226,  dated  July  17,  1997, 
applicable  to  that  airplane  plus  the  following  parameters;  pitch  trim;  trailing  edge  and 
leading  edge  flaps;  thrust  reverser  position  (each  engine);  yaw  damper  command;  yaw 
damper  on/off  discrete;  standby  rudder  on/off  discrete;  and  control  wheel,  control  column, 
and  rudder  pedal  forces  (with  yaw  damper  command;  yaw  damper  on/off  discrete;  and 
control  wheel,  control  column,  and  rudder  pedal  forces  sampled  at  a  minimum  rate  of 
twice  per  second). 

Further,  the  Safety  Board  believes  that  the  FAA  should  require  that  all  737 
airplanes  operated  under  14  CFR  Parts  121  or  125  that  are  not  equipped  with  a  FDAU  be 
equipped,  at  the  earliest  time  practicable  but  no  later  than  August  1,  2001,  with  an  FDR 
system  that  records,  at  a  minimum,  the  parameters  required  by  FAA  Final  Rules  121.344 
and  125.226,  dated  July  17,  1997,  applicable  to  that  airplane  plus  the  following 
parameters:  pitch  trim;  trailing  edge  and  leading  edge  flaps;  thrust  reverser  position  (each 
engine);  yaw  damper  command;  yaw  damper  on/off  discrete;  standby  rudder  on/off 
discrete;  and  control  wheel,  control  column,  and  rudder  pedal  forces  (with  yaw  damper 
command;  yaw  damper  on/off  discrete;  and  control  wheel,  control  column,  and  rudder 
pedal  forces  sampled  at  a  minimum  rate  of  twice  per  second). 

The  Safety  Board  notes  that  737  flight  crews  continue  to  report  anomalous  rudder 
behaviors,  and  it  is  possible  that  another  catastrophic  737  upset-related  accident  could 
occur.  If  such  an  accident  occurs  before  August  19, 2001,  it  is  likely  that  the  data  recorded 
by  the  accident  airplane’s  FDR  will  not  be  sufficient  for  investigators  to  readily  identify 
the  events  leading  to  the  upset  and  develop  corrective  actions  to  prevent  future  similar 
accidents.  Therefore,  the  Safety  Board  concludes  that  the  FAA’s  failure  to  require  timely 
and  aggressive  action  regarding  enhanced  FDR  recording  capabilities,  especially  on  737 
airplanes,  has  significantly  hampered  the  prompt  identification  of  potentially  critical 
safety-of-flight  conditions  and  the  development  of  safety  recommendations  to  prevent 
future  catastrophic  accidents. 
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3.  Conclusions 


3.1  Findings 

Note:  Because  the  Safety  Board’s  analysis  of  the  USAir  flight  427  accident  also 

included  analysis  of  the  United  flight  585  accident  and  the  Eastwind  flight  517  incident, 

some  of  the  findings  pertain  to  these  two  events. 

1.  The  USAir  flight  427  flight  crew  was  properly  certificated  and  qualified  and  had 
received  the  training  and  off-duty  time  prescribed  by  Federal  regulations.  No 
evidence  indicated  any  preexisting  medical  or  behavioral  conditions  that  might  have 
adversely  affected  the  flight  crew’s  performance  during  the  accident  flight. 

2.  The  USAir  flight  427  accident  airplane  was  equipped,  maintained,  and  operated  in 
accordance  with  applicable  Federal  regulations.  The  airplane  was  dispatched  in 
accordance  with  Federal  Aviation  Administration-  and  industry-approved  practices. 

3.  All  of  USAir  flight  427’s  doors  were  closed  and  locked  at  impact. 

4.  USAir  flight  427  did  not  experience  an  in-flight  fire,  bomb,  explosion,  or  structural 
failure. 

5.  A  midair  collision  with  other  air  traffic,  a  bird  strike,  clear  air  turbulence,  or  other 
atmospheric  phenomena  were  not  involved  in  the  USAir  flight  427  accident. 

6.  Asymmetrical  engine  thrust  reverser  deployment,  asymmetrical  spoiler/aileron 
activation,  transient  electronic  signals  causing  uncommanded  flight  control 
movements,  yaw  damper  malfunctions,  and  a  rudder  cable  pull  or  break  were  not 
factors  in  the  USAir  flight  427  accident. 

7.  Although  USAir  flight  427  encountered  turbulence  from  Delta  flight  1083’s  wake 
vortices,  the  wake  vortex  encounter  alone  would  not  have  caused  the  continued 
heading  change  that  occurred  after  1903:00. 

8.  About  1903:00,  USAir  flight  427’s  rudder  deflected  rapidly  to  the  left  and  reached  its 
left  aerodynamic  blowdown  limit  shortly  thereafter. 

9.  Analysis  of  the  human  performance  data  shows  that  it  is  likely  that  the  first  officer 
made  the  first  pilot  control  response  to  the  upset  event  and  manipulated  the  flight 
controls  during  the  early  stages  of  the  accident  sequence;  although  it  is  likely  that 
both  pilots  manipulated  the  flight  controls  later  in  the  accident  sequence,  it  is  unlikely 
that  the  pilots  simultaneously  manipulated  the  controls  (possibly  opposing  each  other) 
during  the  critical  period  in  which  the  airplane  yawed  and  rolled  to  the  left. 
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10.  Analysis  of  the  human  performance  data  (including  operational  factors)  does  not 
support  a  scenario  in  which  the  flight  crew  of  USAir  flight  427  applied  and  held  a  full 
left  rudder  input  until  ground  impact  more  than  20  seconds  later. 

11.  Analysis  of  the  cockpit  voice  recorder,  National  Transportation  Safety  Board 
computer  simulation,  and  human  performance  data  (including  operational  factors) 
from  the  USAir  flight  427  accident  shows  that  they  are  consistent  with  a  rudder 
reversal  most  likely  caused  by  a  jam  of  the  main  rudder  power  control  unit  servo 
valve  secondary  slide  to  the  servo  valve  housing  offset  from  its  neutral  position  and 
overtravel  of  the  primary  slide. 

12.  The  flight  crew  of  USAir  flight  427  recognized  the  initial  upset  in  a  timely  manner 
and  took  immediate  action  to  attempt  a  recovery  but  did  not  successfully  regain 
control  of  the  airplane. 

13.  The  flight  crew  of  USAir  flight  427  could  not  be  expected  to  have  assessed  the  flight 
control  problem  and  then  devised  and  executed  the  appropriate  recovery  procedure 
for  a  rudder  reversal  under  the  circumstances  of  the  flight. 

14.  It  is  very  unlikely  that  the  loss  of  control  in  the  United  flight  585  accident  was  the 
result  of  an  encounter  with  a  mountain  rotor. 

15.  Analysis  of  the  cockpit  voice  recorder.  National  Transportation  Safety  Board 
computer  simulation,  and  human  performance  data  (including  operational  factors) 
from  the  United  Airlines  flight  585  accident  shows  that  they  are  consistent  with  a 
rudder  reversal  most  likely  caused  by  a  jam  of  the  main  rudder  power  control  unit 
servo  valve  secondary  slide  to  the  servo  valve  housing  offset  from  its  neutral  position 
and  overtravel  of  the  primary  slide. 

16.  The  flight  crew  of  United  flight  585  recognized  the  initial  upset  in  a  timely  manner 
and  took  immediate  action  to  attempt  a  recovery  but  did  not  successfully  regain 
control  of  the  airplane. 

17.  The  flight  crew  of  United  flight  585  could  not  be  expected  to  have  assessed  the  flight 
control  problem  and  then  devised  and  executed  the  appropriate  recovery  procedure 
for  a  rudder  reversal  under  the  circumstances  of  the  flight. 

18.  Training  and  piloting  techniques  developed  as  a  result  of  the  USAir  flight  427 
accident  show  that  it  is  possible  to  counteract  an  uncommanded  deflection  of  the 
rudder  in  most  regions  of  the  flight  envelope;  such  training  was  not  yet  developed  and 
available  to  the  flight  crews  of  USAir  flight  427  or  United  flight  585. 

19.  During  the  Eastwind  flight  517  incident,  the  rudder  reversed,  moving  to  its  right 
blowdown  limit  when  the  captain  commanded  left  rudder,  consistent  with  a  jam  of  the 
main  rudder  power  control  unit  servo  valve  secondary  slide  to  the  servo  valve  housing 
offset  from  its  neutral  position  and  overtravel  of  the  primary  slide. 
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20.  It  is  possible  that,  in  the  main  rudder  power  control  units  from  the  USAir  flight  427, 
United  flight  585,  and  Eastwind  flight  517  airplanes  (as  a  result  of  some  combination 
of  tight  clearances  within  the  servo  valve,  thermal  effects,  particulate  matter  in  the 
hydraulic  fluid,  or  other  unknown  factors),  the  servo  valve  secondary  slide  could  jam 
to  the  servo  valve  housing  at  a  position  offset  from  its  neutral  position  without  leaving 
any  obvious  physical  evidence  and  that,  combined  with  a  rudder  pedal  input,  could 
have  caused  the  rudder  to  move  opposite  to  the  direction  commanded  by  a  rudder 
pedal  input. 

21.  The  upsets  of  USAir  flight  427,  United  flight  585,  and  Eastwind  flight  517  were  most 
likely  caused  by  the  movement  of  the  rudder  surfaces  to  their  blowdown  limits  in  a 
direction  opposite  to  that  commanded  by  the  pilots.  The  rudder  surfaces  most  likely 
moved  as  a  result  of  jams  of  the  secondary  slides  to  the  servo  valve  housings  offset 
from  their  neutral  position  and  overtravel  of  the  primary  slides. 

22.  When  completed,  the  rudder  system  design  changes  to  the  Boeing  737  should 
preclude  the  rudder  reversal  failure  mode  that  most  likely  occurred  in  the  USAir  flight 
427  and  United  flight  585  accidents  and  the  Eastwind  flight  517  incident. 

23.  Rudder  design  changes  to  Boeing  737-next-generation  series  airplanes  and  the 
changes  currently  being  retrofitted  on  the  remainder  of  the  Boeing  737  fleet  do  not 
eliminate  the  possibility  of  other  potential  failure  modes  and  malfunctions  in  the 
Boeing  737  rudder  system  that  could  lead  to  a  loss  of  control. 

24.  The  dual-concentric  servo  valve  used  in  all  Boeing  737  main  rudder  power  control 
units  is  not  reliably  redundant. 

25.  A  reliably  redundant  rudder  actuation  system  is  needed  for  the  Boeing  737,  despite 
significant  improvements  made  in  the  system’s  design. 

26.  The  results  of  this  investigation  have  disclosed  that  the  Boeing  737  rudder  system 
design  certificated  by  the  Federal  Aviation  Administration  is  not  reliably  redundant. 

27.  Transport-category  airplanes  should  be  shown  to  be  capable  of  continued  safe  flight 
and  landing  after  a  jammed  flight  control  in  any  position  unless  the  jam  can  be  shown 
to  be  extremely  improbable. 

28.  Pilots  would  be  more  likely  to  recover  successfully  from  an  uncommanded  rudder 
reversal  if  they  were  provided  the  necessary  knowledge,  procedures,  and  training  to 
counter  such  an  event. 

29.  A  neutral  rudder  pedal  position  is  not  a  valid  indicator  that  a  rudder  reversal  in  the 
Boeing  737  has  been  relieved. 

30.  The  training  being  provided  to  many  Boeing  737  flight  crews  on  the  procedures  for 
recovering  from  a  jammed  or  restricted  rudder  (including  a  rudder  reversal)  is 
inadequate. 
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31.  The  continued  use  by  air  carriers  of  airspeeds  below  the  existing  block  maneuvering 
speed  schedule  presents  an  unacceptable  hazard,  and  the  existing  block  maneuvering 
speed  for  the  flaps  1  configuration  provides  an  inadequate  margin  of  controllability  in 
the  event  of  a  rudder  hardover. 

32.  The  flight  data  recorder  (FDR)  upgrade  modifications  required  by  the  Federal 
Aviation  Administration  for  existing  airplanes  are  inadequate  because  they  do  not 
require  the  FDR  to  be  modified  to  record  yaw  damper  command  voltage;  yaw  damper 
and  standby  rudder  on/off  discrete  indications;  pitch  trim;  thrust  reverser  position; 
leading  and  trailing  edge  flap  positions;  and  pilot  flight  control  input  forces  for 
control  wheel,  control  column,  and  rudder  pedals. 

33.  On  the  basis  of  the  rudder-related  anomalies  discussed  in  this  report,  flight  data 
recorder  documentation  of  yaw  damper  command  voltage;  yaw  damper  and  standby 
rudder  on/off  discrete  indications;  and  pilot  flight  control  input  forces  for  control 
wheel,  control  column,  and  rudder  pedals  is  especially  important  in  the  case  of  the 
737,  and  these  parameters  should  be  sampled  on  737  airplanes  at  frequent  intervals  to 
provide  optimal  documentation. 

34.  The  Federal  Aviation  Administration’s  failure  to  require  timely  and  aggressive  action 
regarding  enhanced  flight  data  recorder  recording  capabilities,  especially  on  Boeing 
737  airplanes,  has  significantly  hampered  investigators  in  the  prompt  identification  of 
potentially  critical  safety-of-flight  conditions  and  in  the  development  of 
recommendations  to  prevent  future  catastrophic  accidents. 


3.2  Probable  Cause 

The  National  Transportation  Safety  Board  determines  that  the  probable  cause  of 
the  USAir  flight  427  accident  was  a  loss  of  control  of  the  airplane  resulting  from  the 
movement  of  the  rudder  surface  to  its  blowdown  limit.  The  rudder  surface  most  likely 
deflected  in  a  direction  opposite  to  that  commanded  by  the  pilots  as  a  result  of  a  jam  of  the 
main  rudder  power  control  unit  servo  valve  secondary  slide  to  the  servo  valve  housing 
offset  from  its  neutral  position  and  overtravel  of  the  primary  slide. 
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4.  Recommendations 


As  a  result  of  the  investigation  of  the  USAir  flight  427  accident,  the  National 
Transportation  Safety  Board  makes  the  following  recommendations  to  the  Federal 
Aviation  Administration: 

Require  that  all  existing  and  future  Boeing  737s  have  a  reliably  redundant 
rudder  actuation  system.  (A-99-20) 

Convene  an  engineering  test  and  evaluation  board  to  conduct  a  failure 
analysis  to  identify  potential  failure  modes,  a  component  and  subsystem 
test  to  isolate  particular  failure  modes  found  during  the  failure  analysis,  and 
a  full-scale  integrated  systems  test  of  the  Boeing  737  rudder  actuation  and 
control  system  to  identify  potential  latent  failures  and  validate  operation  of 
the  system  without  regard  to  minimum  certification  standards  and 
requirements  in  14  Code  of  Federal  Regulations  Part  25.  Participants  in  the 
engineering  test  and  evaluation  board  should  include  the  Federal  Aviation 
Administration  (FAA);  National  Transportation  Safety  Board  technical 
advisors;  the  Boeing  Company;  other  appropriate  manufacturers;  and 
experts  from  other  government  agencies,  the  aviation  industry,  and 
academia.  A  test  plan  should  be  prepared  that  includes  installation  of 
original  and  redesigned  Boeing  737  main  rudder  power  control  units  and 
related  equipment  and  exercises  all  potential  factors  that  could  initiate 
anomalous  behavior  (such  as  thermal  effects,  fluid  contamination, 
maintenance  errors,  mechanical  failure,  system  compliance,  and  structural 
flexure).  The  engineering  board’s  work  should  be  completed  by  March  31, 

2000,  and  published  by  the  FAA.  (A-99-21) 

Ensure  that  future  transport-category  airplanes  certificated  by  the  Federal 
Aviation  Administration  provide  a  reliably  redundant  rudder  actuation 
system.  (A-99-22) 

Amend  14  Code  of  Federal  Regulations  Section  25.671(c)(3)  to  require 
that  transport-category  airplanes  be  shown  to  be  capable  of  continued  safe 
flight  and  landing  after  jamming  of  a  flight  control  at  any  deflection 
possible,  up  to  and  including  its  full  deflection,  unless  such  a  jam  is  shown 
to  be  extremely  improbable.  (A-99-23) 

Revise  Airworthiness  Directive  96-26-07  so  that  procedures  for  addressing 
a  jammed  or  restricted  rudder  do  not  rely  on  the  pilots’  ability  to  center  the 
rudder  pedals  as  an  indication  that  the  rudder  malfunction  has  been 
successfully  resolved,  and  require  Boeing  and  U.S.  operators  of  Boeing 
737s  to  amend  their  Airplane  Flight  Manuals  and  Operations  Manuals 
accordingly.  (A-99-24) 
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Require  all  14  Code  of  Federal  Regulations  Part  121  air  carrier  operators  of 
the  Boeing  737  to  provide  their  flight  crews  with  initial  and  recurrent  flight 
simulator  training  in  the  “Uncommanded  Yaw  or  Roll’  and  Jammed  or 
Restricted  Rudder”  procedures  in  Boeing’s  737  Operations  Manual.  The 
training  should  demonstrate  the  inability  to  control  the  airplane  at  some 
speeds  and  configurations  by  using  the  roll  controls  (the  crossover  airspeed 
phenomenon)  and  include  performance  of  both  procedures  in  their  entirety. 
(A-99-25) 

Require  Boeing  to  update  its  Boeing  737  simulator  package  to  reflect  flight 
test  data  on  crossover  airspeed  and  then  require  all  operators  of  the  Boeing 
737  to  incorporate  these  changes  in  their  simulators  used  for  Boeing  737 
pilot  training.  (A-99-26) 

Evaluate  the  Boeing  737’s  block  maneuvering  speed  schedule  to  ensure  the 
adequacy  of  airspeed  margins  above  crossover  airspeed  for  each  flap 
configuration,  provide  the  results  of  the  evaluation  to  air  carrier  operators 
of  the  Boeing  737  and  the  National  Transportation  Safety  Board,  and 
require  Boeing  to  revise  block  maneuvering  speeds  to  ensure  a  safe 
airspeed  margin  above  crossover  airspeed.  (A-99-27) 

Require  that  all  Boeing  737  airplanes  operated  under  14  Code  of  Federal 
Regulations  Parts  121  or  125  that  currently  have  a  flight  data  acquisition 
unit  be  equipped,  by  July  31,  2000,  with  a  flight  data  recorder  system  that 
records,  at  a  minimum,  the  parameters  required  by  Federal  Aviation 
Administration  Final  Rules  121.344  and  125.226,  dated  July  17,  1997, 
applicable  to  that  airplane  plus  the  following  parameters:  pitch  trim; 
trailing  edge  and  leading  edge  flaps;  thrust  reverser  position  (each  engine); 
yaw  damper  command;  yaw  damper  on/off  discrete;  standby  rudder  on/off 
discrete;  and  control  wheel,  control  column,  and  rudder  pedal  forces  (with 
yaw  damper  command;  yaw  damper  on/off  discrete;  and  control  wheel, 
control  column,  and  rudder  pedal  forces  sampled  at  a  minimum  rate  of 
twice  per  second).  (A-99-28) 

Require  that  all  Boeing  737  airplanes  operated  under  14  Code  of  Federal 
Regulations  Parts  121  or  125  that  are  not  equipped  with  a  flight  data 
acquisition  unit  be  equipped,  at  the  earliest  time  practicable  but  no  later 
than  August  1,  2001,  with  a  flight  data  recorder  system  that  records,  at  a 
minimum,  the  parameters  required  by  Federal  Aviation  Administration 
Final  Rules  121.344  and  125.226,  dated  July  17,  1997,  applicable  to  that 
airplane  plus  the  following  parameters:  pitch  trim;  trailing  edge  and 
leading  edge  flaps;  thrust  reverser  position  (each  engine);  yaw  damper 
command;  yaw  damper  on/off  discrete;  standby  rudder  on/off  discrete;  and 
control  wheel,  control  column,  and  rudder  pedal  forces  (with  yaw  damper 
command;  yaw  damper  on/off  discrete;  and  control  wheel,  control  column, 
and  rudder  pedal  forces  sampled  at  a  minimum  rate  of  twice  per  second). 
(A-99-29) 
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BY  THE  NATIONAL  TRANSPORTATION  SAFETY  BOARD 

James  E.  Hall  John  A.  Hammerschmidt 

Chairman  Member 

Robert  T.  Francis  George  W.  Black 

Vice  Chairman  Member 


Member  John  J.  Goglia  did  not  participate. 

March  24, 1999 
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5.  Appendixes 


Appendix  A 

Investigation  and  Hearing 

Investigation 

The  National  Transportation  Safety  Board  was  initially  notified  of  this  accident 
about  1920  on  September  8,  1994.  A  full  go-team  was  assembled  that  evening,  but 
because  of  the  lack  of  availability  of  a  Federal  Aviation  Administration  (FAA)  airplane  or 
commercial  flights,  the  team  did  not  depart  the  Washington,  D.C.,  area  until  the  morning 
of  September  9,  1994.  The  team  arrived  at  the  accident  site  about  0730.  The  following 
investigative  teams  were  formed;  Operations,  Human  Performance,  Aircraft  Structures, 
Aircraft  Systems,  Powerplants,  Maintenance  Records,  Air  Traffic  Control,  Survival 
Factors,  Aircraft  Performance,  Meteorology,  and  Witnesses.  Specialists  were  also 
assigned  to  stand  by  in  the  Safety  Board  laboratories  for  the  cockpit  voice  recorder  and 
flight  data  recorder.  Because  of  the  magnitude  of  the  accident,  two  Safety  Board 
investigators  were  assigned  to  most  groups  on  scene.  Accompanying  the  team  were  Board 
Member  Carl  Vogt,  his  special  assistant,  the  Deputy  Managing  Director,  and  a 
representative  of  the  Safety  Board’s  Public  Affairs  office. 

Parties  to  the  investigation  included  the  FAA;  Boeing  Commercial  Airplane 
Group;  Air  Line  Pilots  Association;  USAir,  Inc.;  National  Air  Traffic  Controllers 
Association;  CFM  International;  AVIALL;  International  Association  of  Machinists  and 
Aerospace  Workers;  Transportation  Workers  Union  No.  545;  the  Association  of  Flight 
Attendants;  Parker  Berta  Aerospace/Parker  Hannifin  Corporation;  and  Monsanto 
Company.  Assistance  was  also  provided  by  the  Federal  Bureau  of  Investigation,  Armed 
Forces  Institute  of  Pathology,  Hopewell  Township,  Pennsylvania  State  Police, 
Pennsylvania  Emergency  Management  Agency,  the  Beaver  County  Coroner  s  Office,  and 
emergency  response  personnel  from  Beaver  and  Allegheny  Counties. 

Additionally,  air  safety  investigators  from  the  aircraft  accident  investigation 
authorities  from  the  United  Kingdom,  France,  Denmark,  Australia,  and  Canada 
participated  in  the  investigation  as  technical  observers  in  accordance  with  prior 
arrangements  for  such  participation. 


Public  Hearing 

Two  sessions  of  a  public  hearing  were  conducted  for  this  accident.  The  first 
session  was  held  on  January  23  through  27,  1995.  The  second  session  was  held  on 
November  15  through  17,  1995.  Parties  to  the  public  hearing  were  the  FAA,  Boeing,  Air 
Line  Pilots  Association,  USAir,  International  Association  of  Machinists  and  Aerospace 
Workers,  Parker  Berta  Aerospace/Parker  Hannifin  Corporation,  and  Monsanto  Company. 
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Appendix  B 

Cockpit  Voice  Recorder  Transcript 


The  following  is  a  transcript  of  the  Fairchild  A- 100  cockpit  voice  recorder  (CVR) 
installed  on  the  Boeing  737-300,  N513AU,  that  crashed  while  approaching  Pittsburgh 
International  Airport,  Pittsburgh,  Pennsylvania,  on  September  8,  1994. 


LEGEND 


RDO  Radio  transmission  from  accident  aircraft 

CAM  Voice  or  sound  source  recorded  through  cockpit  area  microphone 

HOT  Voice  or  sound  source  recorded  through  cockpit  hot  microphone 

PA  Voice  or  sound  source  recorded  through  public  address  system 

JSAP  Voice  or  sound  source  recorded  through  jumpseat  audio  panel 

-1  Voice  identified  as  captain 

-2  Voice  identified  as  first  officer 

-3  Voice  identified  as  femaie  flight  attendant 

-4  Voice  identified  as  male  flight  attendant 

CTR-?  Radio  transmission  from  unidentified  Center  controller 

CLE1  Radio  transmission  from  1  st  Cleveland  Center  controller 

CLE2  Radio  transmission  from  2nd  Cleveland  Center  controller 

CLE3  Radio  transmission  from  3rd  Cleveland  Center  controller 

CLE4  Radio  transmission  from  4th  Cleveland  Center  controller 

AXIS  Radio  transmission  from  Pittsburgh  automatic  terminal  information  service 

APR1  Radio  transmission  from  1st  Pittsburgh  approach  controller 

APR2  Radio  transmission  from  2nd  Pittsburgh  approach  controller 

US1 41 7  Radio  transmission  from  USAir  flight  1417 

US1499  Radio  transmission  from  USAir  flight  1499 

US1 874  Radio  transmission  from  USAir  flight  1 874 

US1 462  Radio  transmission  from  USAir  flight  1 462 

US1 674  Radio  transmission  from  USAir  flight  1 674 

DL1 083  Radio  transmission  from  Delta  flight  1 083 

US374  Radio  transmission  from  USAir  flight  374 
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285LM  Radio  transmission  from  aircraft  285  LM 

US309  Radio  transmission  from  USAir  flight  309 

*  Unintelligible  word  ^ 

@  Nonpertinent  word 

#  Expletive 

%  Break  in  continuity 

( )  Questionable  Insertion 

[  ]  Editorial  insertion 

Pause 

Note:  The  CVR  transcript  reflects  the  final  30  minutes  56  seconds  of  the  accident 
flight.  Times  are  expressed  in  eastern  daylight  time,  based  on  a  24-hour  clock. 
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1847:27 

RDO-1  twenty  eight  fifteen,  USAir  four  twenty  seven,  good 
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HOT-1  it's  true. 
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HOT-2  oh  why  did  it  *? 
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CAM-3  OKedoky. 
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CAM-3  cranberry  orange  and  diet  sprite. 
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APR  USAir  four  twenty  seven,  descend  and  maintain  six 

thousand. 
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HOT-1  aah,  where  are  we  ....  landing  data  is  .. 
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APR  USAir  three  seventy  four,  contact  approach  one  two 
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1900:13 

DL1083  one  thirty  one  ninety  speed,  Delta  ten  eighty  three. 
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APR  five  Lima  Mike  contact  Pittsburgh  departure  one  two 

four  point  seven  five. 
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1901:06 

CAM  [chime  similar  to  seatbelt  chime] 
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1901 :42 

HOT-2  Bravo  thirty  nine  ....  that's  not  too  bad  that's  . 
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HOT-2  that  sun  is  gonna  be  just  like  it  was  takin'  off  in  Cleveland 
yesterday  too.  I’m  just  gonna  close  my  eyes,  [sound  of 
laughter]  you  holler  when  it  iooks  like  we're  ciose.  [sound 
of  laughter] 
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1903:01.5 

HOT-2  [sound  similar  to  pilot  loud  grunting] 

1903:01.9 

HOT-1  hang  on. 
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Appendix  C 

History  of  Federal  Aviation  Administration  Airworthiness 
Directives  Related  to  the  Boeing  737  Rudder  System 


FAA  records  indicate  that  10  airworthiness  directives  (AD)  related  to  the  Boeing 
737  rudder  system  have  been  issued  since  1980.  Each  of  these  ADs  is  described  below  and 
summarized  in  the  table  that  follows. 

On  April  21,  1980,  AD  80-07-02  became  effective.  It  required  a  test  on  Boeing 
737  airplanes  within  3  days  to  determine  if  the  main  rudder  power  control  unit  (PCU)  and 
other  flight  components  could  fail.  The  AD  was  prompted  by  a  finding  that  components 
manufactured  by  a  company  other  then  Parker  were  installed  in  the  PCU  by  a  repair 
station  or  operator. 

On  March  3,  1994,  AD  94-01-07  became  effective.  It  required  a  test  of  the  main 
rudder  PCU  every  750  flight  hours  until  the  PCU  was  replaced  with  a  PCU  incorporating  a 
redesigned  servo  valve.  This  test  was  used  to  determine  if  the  PCU  servo  valve  was  in 
proper  operating  condition  by  evaluating  rudder  system  hydraulic  flow  or  internal  leakage 
within  the  servo  valve  resulting  from  improperly  positioned  servo  valve  slides.  The 
750-hour  test  requirement  was  removed  when  the  PCU  was  replaced  with  a  redesigned 
servo  valve.  The  USAir  flight  427  aircraft  had  been  tested  for  compliance  with  the  AD  on 
March  21,  June  18,  and  August  8,  1994.  AD  94-01-07  was  superceded  by  AD  97-14-04 
(which  became  effective  on  August  4,  1997. 

On  March  14,  1995,  telegraphic  AD  95-06-53  was  issued  regarding  certain  737s 
that  had  PCUs  serviced  by  a  repair  station.  The  FAA  determined  that  assembly  methods 
for  the  PCU  servo  valve  did  not  guarantee  that  the  servo  valve  primary  and  secondary 
slides  would  be  properly  set,  which  could  result  in  the  servo  valve  not  functioning 
properly.  The  AD  required  removing  or  testing  of  the  suspect  parts  within  the  next  five 
flights.  This  action  affected  approximately  50  airplanes. 

On  November  27,  1996,  AD  96-23-51  became  effective.  It  required  all  737  series 
airplanes  to  be  inspected  within  10  days  and  every  250  flight  hours  afterward.  This  AD 
was  the  result  of  findings  related  to  testing  of  the  main  rudder  PCU  during  the  USAir 
flight  427  accident  investigation.  These  findings  indicated  that  a  jam  of  the  secondary 
slide  to  the  servo  valve  housing  and  subsequent  rudder  input  could  result  in  the  rudder 
moving  opposite  of  its  intended  direction.  The  AD  required  that  a  full  rudder  pedal 
displacement  be  made  to  the  travel  limit  of  the  rudder  and  then  a  sudden  full  pedal 
command  be  made  to  the  opposing  direction.  If  the  pedals  moved  normally,  the  test  was 
successful;  if  they  did  not,  the  rudder  PCU  was  required  to  be  replaced  immediately.  The 
250-hour  test  requirement  was  removed  when  the  PCU  was  replaced  with  one  that 
incorporated  a  redesigned  servo  valve.  AD  96-23-51  was  superceded  by  AD  97-14-04 
(which  became  effective  on  August  4, 1997). 
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On  January  17,  1997,  AD  96-26-07  became  effective.  The  AD  required  revising 
the  airplane  flight  manual  (AFM)  for  all  737  series  airplanes  within  30  days  to  include 
procedures  that  would  enable  the  flight  crew  to  take  “appropriate  action  to  maintain 
control  of  the  airplane  during  an  uncommanded  yaw  or  roll  condition”  and  correct  a 
jammed  or  restricted  flight  control  condition.”  The  FAA  stated  that  the  AD  had  been 
prompted  because  such  procedures  were  not  defined  adequately  in  the  existing  version  of 
the  737  AFM.  The  AD  established  a  “recall”  procedure  to  be  performed  by  flight  crews 
immediately,  from  memory,  in  the  event  of  an  uncommanded  yaw  or  roll.  The  FAA 
specified  that  air  carriers  could  comply  with  the  AD  by  inserting  a  copy  of  it  in  the  AFM. 

On  March  19,  1997,  AD  97-05-10  became  effective.  It  required  certain  737  main 
rudder  PCUs  to  be  removed  or  tested  within  90  days  to  determine  if  they  had  been 
assembled  by  a  repair  station  with  an  incorrect  fastener  used  to  retain  the  summing  levers. 
This  anomaly  was  discovered  when  an  operator  noted  cracking  of  the  summing  lever 
bearing.  The  FAA  found  that  the  fastener  installed  by  the  repair  station  caused  the  bearing 
to  crack.  This  AD  affected  approximately  200  PCUs. 

On  June  9,  1997,  AD  97-09-15  became  effective.  It  required  an  inspection  of  the 
yaw  damper  engage  solenoid.  If  the  solenoid  part  number  was  within  a  specified  range, 
the  solenoid  valve  was  required  to  be  replaced  with  a  redesigned  valve.  This  AD  resulted 
from  Safety  Board’s  test  findings  in  connection  with  the  investigation  of  USAir  flight  427 
accident,  which  indicated  that  hydraulic  fluid  was  contaminating  the  coils  of  the  valve  and 
causing  it  to  fail.  The  redesigned  valve  utilized  sealed  coils  that  were  impervious  to 
hydraulic  fluid.  The  AD  required  that  the  valves  be  replaced  within  5  years  or  15,000 
flight  hours  after  the  AD’s  effective  date  or  the  next  time  the  PCU  was  sent  to  a  repair 
facility,  whichever  was  earlier. 

On  August  1,  1997,  AD  97-14-03  became  effective.  It  requires  the  installation, 
within  3  years,  of  a  newly  designed  rudder  surface  limiting  device  that  reduces  the  rudder 
authority  at  flight  conditions  in  which  full  rudder  authority  is  not  required.  It  also  required 
the  installation  of  a  redesigned  yaw  damper  system  with  improved  reliability  and  fault 
monitoring  capabilities.  These  actions  were  the  result  of  Safety  Recommendations 
A-96-107  and  -110,  which  were  issued  on  October  18, 1996,  in  connection  with  the  USAir 
flight  427  accident  investigation. 

On  August  4,  1997,  AD  97-14-04  became  effective.  It  required  that  all  actions 
included  in  ADs  94-01-07  and  96-23-51  be  implemented  and  that,  within  2  years,  all  main 
rudder  PCUs  be  replaced  with  a  PCU  that  has  a  redesigned  servo  valve.  The  AD  also 
required  that  the  PCU’s  vernier  control  rod  bolts  be  replaced  with  bolts  that  are  less  likely 
to  fail  and  that  a  leak  test  be  performed  on  the  PCU  within  4,000  to  6,000  flight  hours  of 
the  AD’s  effective  date  and  at  6,400  hour  intervals  thereafter.  This  leak  test  was  designed 
to  detect  latent  jams  of  the  servo  valve  slides. 

On  January  20,  1998,  AD  97-26-01  became  effective.  It  required  an  inspection  to 
detect  galling  on  the  standby  rudder  actuator  input  bearing  and  shaft  within  18  months  or 
4,500  flight  hours.  The  shaft  and  bearing  are  to  be  replaced  with  a  redesigned  shaft  and 
bearing  within  3  years  of  the  AD’s  effective  date.  This  AD,  which  affected  approximately 
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2,800  airplanes,  was  the  result  of  findings  related  to  the  investigation  of  the  United 
Airlines  flight  585  accident  and  Safety  Recommendation  A-96-115,  issued  on  October  18, 
1996,  in  connection  with  the  US  Air  flight  427  accident  investigation. 


AD 

number 

Title 

Affected 

airplanes 

Effective 

date 

Compliance 

deadline 

Description 

80-07-02 

Flight 

Control 

Systems 

All  model  707, 
720,  727,  737, 
and  747  series 
airplanes  that 
contain  specific 
hydraulic 
components 
manufactured 
by  Fortner 
Engineering  and 
Manufacturing. 

04/21/80 

3  days  after 
the  AD’s 
effective 
date. 

Conduct  a  one-time  manual 
input  hardover  test  on  the 
flight  control  systems 
(including  the  rudder, 
elevators,  and  ailerons). 

94-01-07 

Main 

Rudder 

PCU 

Model  737 
series  airplanes, 
line  positions  1 
through  2453 
(Inclusive). 

03/03/94 

Within  750 
flight  hours 
after  the 

AD’S 

effective 

date. 

Perform  a  test  of  the  main 
rudder  PCU  to  detect 
internal  leakage  of 
hydraulic  fluid.  Repeat  test 
at  750-hour  intervals  unless 
replaced  with  new  main 
rudder  PCU.  Superseded 
by  AD  97-14-04. 

95-06-53 

Rudder 

Actuator 

Piston 

All  model  737 
series  airplanes. 

03/14/95 

Within  5 
flights  after 
the  AD’S 
effective 
date. 

Compare  part  and  serial 
numbers  of  the  main  rudder 
PCU  with  those  on  a  list  of 
suspect  parts.  If  applicable, 
remove  and  replace  PCU 
with  serviceable  part  or 
perform  specified  testing. 

96-23-51 

Main 

Rudder 

PCU 

All  model  737 
series  airplanes. 

11/27/96 

Within  10 
days  after 
the  AD’S 
effective 
date. 

Perform  testing  of  the  main 
rudder  PCU  in  accordance 
with  Boeing  Alert  Service 
Bulletin  737-27A1202. 

Repeat  test  at  250-hour 
intervals  unless  replaced 
with  new  main  rudder  PCU. 
Superseded  by 

AD  97-14-04. 

96-26-07 

737  AFM 
Revision 

All  model  737 
series  airplanes. 

01/17/97 

Within  30 
days  after 
the  AD’s 
effective 
date. 

Revise  the  AFM  to  include 
procedures  that  would 
enable  the  flight  crew  to 
take  appropriate  action  to 
maintain  control  of  the 
airplane  during  an 
uncommanded  yaw  or  roll 
and  correct  a  jammed/ 
restricted  flight  control 
condition. 
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AD 

number 

Title 

Affected 

airplanes 

Effective 

date 

Compliance 

deadline 

Description 

97-05-10 

Main 

Rudder 

PCU 

Model  737 
series  airplanes 
with  a  main 
rudder  PCU 
identified  in 

Boeing  Service 
Letter  737-SL- 
27-112-B,  dated 
02/06/97. 

03/19/97 

90  days  after 
the  AD’s 
effective 
date. 

Remove  the  main  rudder 

PCU  and  replace  the 
improper  fastener  with  a 
correct  fastener  or  perform 
specified  testing. 

97-09-15 

Engage 

Solenoid 

Valve 

Inspection 

All  model  737- 
100  through 
-500  series 
airplanes. 

06/09/97 

5  years  or 
15,000  flight 
hours  after 
the  AD’S 
effective  date 
or  the  next 
time  the  PCU 
is  sent  to  a 
repair  facility. 

Perform  a  one-time 
inspection  of  the  engage 
solenoid  valve  of  the  yaw 
damper  to  determine  the 
part  number  (P/N)  of  the 
valve.  If  the  valve  P/N  falls 
within  the  range  specified, 
replace  the  valve  with  a 
new  one. 

97-14-03 

Rudder 
Authority 
and  Yaw 
Damper 
System 

All  model  737- 
100  through 
-500  series 
airplanes. 

08/01/97 

Within 

3  years  of 
the  AD’S 
effective 
date. 

Install  a  newly  designed 
rudder  limiting  device  that 
reduces  the  rudder 
authority  during  flight 
conditions  for  which  full 
rudder  authority  is  not 
required.  Install  a  newly 
designed  yaw  damper 
system  that  Improves 
reliability  and  fault 
monitoring  capability. 

97-14-04 

Main 

Rudder 

PCU 

All  model  737- 
100  through 
-500  series 
airplanes. 

08/04/97 

Within 

2  years  after 
the  AD’S 
effective 
date. 

Perform  all  actions  required 
by  ADs  94-01-07  and 
96-23-51.  Replace  any 
main  rudder  PCU  having 
Boeing  P/N  65-44861  or 

P/N  65C37052  with  a  new 
main  rudder  PCU.  Replace 
the  vernier  control  rod  bolts 
having  Boeing  P/N 

69-27229  with  new  bolts. 
Perform  a  leak  test  of  the 
main  rudder  PCU  within 

4,000  to  6,000  hours  of  the 
AD’S  effective  date.  Repeat 
the  leak  tests  at  6,400-hour 
intervals. 
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AD 

number 


97-26-01  Standby 
Rudder 
PCU  Input 
Shaft  and 
Bearing 


Affected 

airplanes 


Standby  Model  737-100 

Rudder  through  -500 

PCU  Input  series  airplanes, 
Shaft  and  line  numbers  1 

Bearing  through  2814 

Inspection  (Inclusive). 


Compliance 

deadline 

Description 

Within  1 8  Perform  an  inspection  to 

months  or  detect  galling  on  the  input 
4,500  hours  shaft  and  bearing  of  the 
after  the  standby  rudder  PCU  within 

AD’S  18  months  or  4,500  hours 

effective  after  the  AD’s  effective 

date.  date,  whichever  occurs 

later.  Replace  the  input 
bearing  of  the  standby 
rudder  PCU  with  an 
improved  bearing  within 
3  years  after  the  AD’s 
effective  date. 
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Appendix  D 

Critical  Design  Review  Recommendations  and 
Federal  Aviation  Administration  Responses 


Because  the  USAir  flight  427  accident  and  other  737  accidents  and  incidents 
raised  questions  regarding  the  737’s  flight  control  systems,  on  October  20,  1994,  the  FAA 
initiated  a  Critical  Design  Review  (CDR)  of  the  737  flight  control  systems  with  emphasis 
on  the  roll  control  and  directional  flight  control  systems.  The  CDR  team  included  seven 
flight  control  specialists  from  the  FAA,  Transport  Canada,  and  the  U.S.  Air  Force.  The 
team’s  final  report,  entitled  B-737  Flight  Control  System  Critical  Design  Review,  was 
issued  on  May  3, 1995. 

The  FAA’s  responses  to  the  CDR  team’s  27  recommendations  were  presented  in  an 
August  27,  1998,  letter  to  the  Safety  Board.  The  CDR  team’s  recommendations  and  the 
FAA’s  responses  were  described  in  the  FAA’s  letter  as  follows: 

CDR  Recommendation  1:  Develop  national  policy  and/or  rulemaking  as 
necessary  and  applicable  to  transport-category  airplanes  that  defines 
“normal”  with  respect  to  jams.  This  definition  should  include  consideration 
of  a  jam  of  a  control  surface  at  any  position  up  to  its  full  deflection  as 
limited  by  design. 

CDR  Recommendation  2:  Develop  national  policy  requiring  that,  when 
alternate  means  for  flying  an  airplane  are  employed,  those  means  shall  not 
require  exceptional  pilot  skill  and  strength  and  that  the  pilot  can  endure  the 
forces  for  a  sufficient  period  of  time  to  ensure  a  safe  landing. 

CDR  Recommendation  3:  Formally  establish  the  transport-category 
airplane  requirement  for  redundancy  in  the  directional  control  system  to 
maintain  control  in  the  event  of  a  rotor  burst  for  the  most  critical  phase  of 
flight.  Determine  whether  this  requirement  should  be  applied  to  new  type- 
certificate  applications,  derivative  applications,  or  aircraft  in  production. 

FAA  Response  to  CDR  Recommendations  1. 2.  and  3:  Public  meeting  on 
12/03/96  held  to  discuss  flight  control  jam  “normally  encountered” 
condition.  Issue  will  go  to  new  working  group  in  ARAC  [Aviation 
Rulemaking  Advisory  Committee].  Terms  of  reference  for  the 
harmonization  of  requirements  has  been  developed  to  guide  the  effort. 
Schedule  for  completion  to  be  determined. 

CDR  Recommendation  4:  Develop  national  policy  for  transport-category 
airplanes  requiring  the  determination  of  critical  hydraulic  flight  control 
system  and  component  sensitivity  (jam  potential  and  actuator  performance) 
to  contamination,  requirements  for  sampling  hydraulic  fluid,  and 
requirements  for  actuator  components  to  eliminate  or  pass  (shear) 
particulate  contamination. 

FAA  Response  to  CDR  Recommendation  4:  SAE  [Society  of 
Automotive  Engineers]  A-6  Committee  has  made  recommendations  on 
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chip  shear  requirements;  FAA  review  of  requirements  to  be  completed 
April  1998.  SAE  A-6  recommendations  made  on  contamination  to  be 
completed  October  1998. 

CDR  Recommendation  5:  Develop  and  provide  additional  guidance  in  AC 
[Advisory  Circular]  1309-1 A  confirming  that  transport-category  airplane 
failure  analysis  action  items  are  required  flight  procedures  in  response  to 
the  failure  condition. 

CDR  Recommendation  6:  Require  the  action  items  be  practical. 

FAA  Response  to  CDR  Recommendations  5  and  6:  ARAC  working 
group  activity. 

CDR  Recommendation  7:  Establish  process  in  cooperation  with  AES  [the 
FAA’s  Flight  Standards  Service]  to  require  flight  crew  action  items  be 
implemented  or  require  revision  of  failure  analysis  to  not  require  action 
item. 

FAA  Response  to  CDR  Recommendation  7:  Process  for  reviewing 
engineering  determination  of  flight  crew  action  following  failure  is  under 
review. 

CDR  Recommendation  8:  Review  the  adequacy  of  the  737  aileron  transfer 
mechanism  throughout  the  airplane  operating  envelope  in  the  event  of  a 
sustained  jam  of  the  ailerons  up  to  their  limit  deflection.  Pilot  skill  and 
strength  requirements  should  be  consistent  with  the  results  of  [CDR] 
Recommendation  2.  Control  margins  from  this  condition  should  be 
sufficient  to  allow  continued  safe  flight  and  landing,  including  necessary 
maneuvers  such  as  a  crosswind  landing  or  go-around. 

CDR  Recommendation  9:  Ensure  that  the  capability  of  the  737  lateral  [roll] 
control  system  to  provide  adequate  directional  control  is  clearly 
demonstrated  throughout  the  airplane  operating  envelope  after  these 
failures,  unless  they  are  shown  to  be  extremely  improbable  by  the  most 
rigorous  methodology  available. 

FAA  Response  to  CDR  Recommendations  8  and  9:  Aileron  transfer 
mechanism  data  reviewed  and  approved  11/30/95.  AD  96-26-07  addresses 
adequacy  of  lateral  [roll]  control  to  provide  directional  control.  No  further 
action  planned. 

CDR  Recommendation  10:  Determine  the  requirement  for  and  the 
feasibility  of  incorporating  additional  means  to  protect  these  components 
[as  addressed  in  Recommendations  8  and]  in  the  main  wheel  well  of  the 
737  from  the  effects  of  environmental  debris. 

CDR  Recommendation  11:  Ensure  the  incorporation  of  wheels  based  on 
TSO-C26  Revision  C  or  later  revision. 

FAA  Response  to  CDR  Recommendations  10  and  11:  AD  97-01-10 
issued  08/12/97,  and  AD  97-18-06  issued  10/08/97.  No  further  action 
planned. 
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CDR  Recommendation  12:  Require  failure  analysis  of  the  737  yaw  damper 
identified  components  and  any  relevant  tests  be  conducted  to  identify  all 
failure  modes,  malfunctions,  and  potential  jam  conditions  of  these  vital 
elements. 

CDR  Recommendation  13:  Require  corrective  action(s)  for  those  failure 
modes  or  malfunctions  [as  addressed  in  Recommendation  12]  not  shown  to 
be  extremely  improbable. 

FAA  Response  to  CDR  Recommendations  12  and  13:  Analysis 
completed  by  the  FAA  on  11/30/95.  No  further  action  planned. 

CDR  Recommendation  14:  Require  appropriate  action  be  taken  to  reduce 
the  number  of  737  yaw  damper  failure  occurrences  to  an  acceptable  level. 

FAA  Response  to  CDR  Recommendation  14:  AD  98-02-01  in  Federal 
Register  02/17/98;  AD  97-14-03  issued  06/23/97;  AD  97-09-15  issued 
04/24/97  (currently  being  revised — ^NPRM  for  revision  in  Federal  Register 
11/13/97,  docket  number  97-NM157AD). 

CDR  Recommendation  15:  Require  appropriate  action  be  taken  to  correct 
the  referenced  galling  condition  of  the  standby  rudder  on  the  737. 

FAA  Response  to  CDR  Recommendation  15:  AD  97-26-01  was  issued 
on  12/08/97;  no  further  action  planned. 

CDR  Recommendation  16:  Review  and  revise,  as  appropriate,  the  737 
inspection  tasks  associated  with  the  latent  failures  identified  in  Tables  3 
and  4  in  Section  10  [of  the  final  CDR  report]  in  accordance  with  MSG-3 
[Maintenance  Steering  Group  3]. 

CDR  Recommendation  17:  Require  that  the  identified  latent  failures  have 
fixed-interval  inspection  frequencies,  as  provided  by  ACs  25. 1309-1 A  and 
25-19.  Consideration  should  be  given  to  interval  ranges  flexible  enough  to 
allow  normal  inspection  schedules. 

CDR  Recommendation  18:  Revise  the  737  MRB/MPD  [Maintenance 
Review  Board/Maintenance  Planning  Document]  inspection  task 
description  and  interval  for  the  following  latent  failures: 


Latent  failure 

Recommended 
inspection  interval 

Tasks 

Aileron  transfer  mechanism 

<1C 

Operational  check 

<3C 

Measure  forces  at  wheel 

Aileron  spring  cartridge 

Operational  check  conducted  with  the 
transfer  mechanism  inspection 

Standby  hydraulic  system, 
including  rudder  function 

<  1A 

Operational  check 
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FAA  Response  to  CDR  Recommendations  16. 17.  and  18:  MRB  review 
completed,  and  corrections  incorporated. 

CDR  Recommendation  19:  Revise  737  flight  crew  training  programs  to 
ensure  the  use  of  the  proper  procedures  for  recovery  from  flightpath  upsets 
and  flight  crew  awareness  regarding  the  loss  of  airplane  performance  due 
to  a  flight  control  system  malfunction.  Consideration  should  be  given  to 
flight  crew  action  items  as  a  consequence  of  the  failure  analysis  developed 
for  the  relevant  flight  control  system  and  the  failure  conditions/ 
malfunctions  examined  in  Appendix  5  [of  the  CDR  final  report].  (This  may 
require  Airplane  Flight  Manual  or  Operations  Manual  revision.) 

FAA  Response  to  CDR  Recommendation  19:  AD-96-26-07  addresses 
issue  for  the  737. 

CDR  Recommendation  20:  Require  that  only  PC-  [production  certificate] 
or  PMA-  [parts  manufacturing  approval]  approved  replacement  parts  be 
used  when  overhauling  primary  elements  in  the  flight  control  system 
(hydraulic  servos  and  bypass  valves)  of  the  737  airplanes.  Ensure 
replacement  parts,  as  provided  by  a  non-original  equipment  manufacturer 
(OEM)  or  fabricated  under  SEAR  [Special  Federal  Aviation  Regulation]  36 
authority,  that  are  used  when  overhauling  primary  elements  in  the  flight 
control  system  have  had  their  designs  approved  and  processed  through  the 
ACO  [Aircraft  Certification  Office]  that  originally  approved  the  OEM 
parts.  This  means  that  the  replacement  parts  will  have  undergone 
qualification  in  terms  of  design  (including  material,  heat  treat,  dimensions, 
tolerances,  and  geometric  controls),  analysis,  and  tests  (qualification  and 
acceptance)  equivalent  to  the  OEM  certified  part.  An  analysis  is  necessary 
to  verify  that  the  replacement  part  will  mate  properly  with  the  next 
assembly  under  all  design  tolerance  conditions. 

FAA  Response  to  CDR  Recommendation  20:  Flight  Standards 
Information  Bulletin  dated  02/13/96  provides  guidance. 

CDR  Recommendation  21:  Require  any  issuance  of  PMA  for  primary 
flight  control  servo  and  bypass  valves  be  concurred  with  the  Aircraft 
Certification  Office  that  certified  the  original  parts  or  assembly. 

FAA  Response  to  CDR  Recommendation  21:  Under  review. 

CDR  Recommendation  22:  Form  a  team  composed  of  a  systems  engineer,  a 
manufacturing  inspector,  and  an  airworthiness  maintenance  inspector  to 
assess  the  repair  procedures,  process,  and  tooling  used  in  every  repair 
station  approved  by  the  FAA  to  overhaul  the  737  PCU  and  its  components. 
In  addition,  this  team  should  reassess  all  737  PCU  PMAs  and  SFAR  36 
data  (design,  manufacturing,  and  fabrication)  approvals  for  adequacy  in 
consideration  of  [CDR]  Recommendations  20  and  21. 

FAA  Response  to  CDR  Recommendation  22:  Flight  Standards 
Information  Bulletin  dated  02/13/96  provides  guidance. 

CDR  Recommendation  23:  Evaluate  the  adequacy  of  the  737  maintenance 
manual  actions  addressing  flight  control  cable  inspection,  rigging 
procedures,  and  replacement  criteria. 
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CDR  Recommendation  24:  Require  control  cable  service  life  limits  unless 
acceptable  inspection  and/or  test  procedures  are  developed  and  utilized  to 
determine  the  continuing  serviceability  of  the  control  cables. 

FA  A  Response  to  CDR  Recommendations  23  and  24:  Cable 
maintenance  practice  revised  during  period  of  11/95  through  12/96.  Boeing 
Maintenance  Manuals  revised  to  provide  for  comprehensive  control  cable 
inspection.  These  two  recommendations  are  completed. 

CDR  Recommendation  25:  Determine  the  degree  of  incorporation  of  the 
following  list  of  Service  Bulletins  (includes  In-Service  Activities  Report) 
in  the  737  fleet  and,  in  consideration  of  the  recommendations  in  Section  15 
[of  the  CDR  final  report],  reassess  their  safety  impact  and,  as  appropriate, 
require  their  incorporation  on  applicable  models  of  the  737. 


737  Service  Bulletins 


No. 

Title 

Date 

B737-27-1060 

Rudder  Pressure  Reducer  and  Relief  Valve 
Inspection/Removal 

Oct.  3,  1972 

B737-27-1033 

Improvement  of  Lateral  Control  Transfer  Mechanism 

Feb.  13,  1970 

B737-27-1081 

Inspection  of  Ground  Spoiler  Shutoff  Valve  Control 

Cable  Assembly 

Dec.  10,  1976 

B737-27-1125 

Flight  Controls,  Cable  Guard  Modification  (Pitch) 

Mar.  8,  1985 

B737-27-1134 

Flight  Controls,  Aileron  Centering  and  Trim 

Mechanism  Modification 

July  11, 1986 

B737-27-1152 

Flight  Controls,  Aileron  Trim  Bracket  Replacement 

May  12,1988; 

Dec.  22,1988 
(rev.  2) 

B737-27-1154 

Flight  Controls,  Aileron  Pulley  Bracket  Inspection/ 
Replacement 

Aug.  25, 1988 

B737-27-1155 

Flight  Controls,  Aileron  Centering  Spring  and  Trim 
Mechanism  Modification 

Oct.  26, 1989 

B737-29-1062 

Hydraulic  Power,  Main  and  Auxiliary,  Standby  and 
Ground  Service  Pressure  Filter  Modification 

Feb.  14. 1991 

737  In-Service  Activities  Report 


No. 

Title 

Date 

95-04-2725-10 

Rudder  Power  Control  Unit  (PCU)  Yaw  Damper 

Solenoid  Valve  configuration  for  use  on  Rudder  PCU 
Spec.  No.  10-60881-8  and  -13 

Feb.  24, 1995 
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FAA  Response  to  CDR  Recommendation  26:  AD  97-05-09  issued 
02/25/97,  and  AD  97-09-14  issued  04/24/97.  No  further  action  planned. 

CDR  Recommendation  27 :  Request  that  the  NTSB  form  a  special  accident 
investigation  team  to  begin  a  new  combined  investigation  of  both  the  737 
Colorado  Springs  and  the  Pittsburgh  accidents.  The  accident  investigation 
team  should  include  an  FAA  representative  from  the  CDR  team  and  the 
NTSB  aviation  safety  investigator  that  worked  with  the  CDR  team.  This 
will  ensure  that  all  of  the  data  from  the  CDR  is  available  for  review  by  the 
accident  investigation  team.  It  is  further  recommended  that  NTSB 
personnel  on  the  team  not  be  from  the  original  accident  investigation  teams 
and  that  the  NTSB  include  at  least  two  accident  investigators  (one  each — 
airplane  systems  and  flight  operation)  from  another  competent  aviation 
authority  of  the  world  who  has  experience  with  737  airplanes. 

FAA  Response  to  CDR  Recommendation  27:  NTSB  has  formed  a  special 
group  of  consultants  in  support  of  the  ongoing  accident  investigation. 


Letter  No. 


B737-SL-27-57 


B737-SL-27-71-A 


Rudder  Trim  Control  Actuator  Lubrication 


Rudder  Centering  Unit  Lubrication 


Aileron/Elevator  and  Rudder  Power  Control  Unit 
Cylinder  Bore  Rework 


Rudder  Feel  and  Centering  Unit  Lubrication 


Aileron/Elevator  PCU  Flow  Restrictor  Filter 
Screen  Contamination 


Date 

Aug.  25, 1980 
June  28, 1983 
Apr.  1, 1985 
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Appendix  E 

List  of  Documented  Boeing  737  Events 


In  addition  to  the  USAir  flight  427  accident,  the  Safety  Board  has  investigated 
more  than  100  events  since  1980  involving  the  Boeing  737.  The  table  below  documents 
the  date  and  location  of  these  events  and  provides  a  brief  description  for  each. 
(Abbreviations  are  defined  at  the  end  of  the  table.)  Additional  details  for  some  of  these 
events  can  be  found  in  the  factual  information  section  of  this  report.  This  list  should  not  be 
considered  a  complete  list  of  every  737  rudder-related  event  that  has  occurred. 


Date 

Location 

737 

series 

Carrier 

Comment/event 

06/11/80 

Cheyenne,  Wyoming 

-200 

Frontier 

First  officer  incapacitation 

09/24/89 

LaGuardia  Airport,  New 

York 

-400 

USAir 

Rudder  trim  mis-set;  rejected 
takeoff 

02/25/91 

N/A 

-200 

United 

Yaw  anomalies  on  585  airplane 

03/03/91 

Colorado  Springs, 

Colorado 

-200 

United 

Flight  585  accident 

07/16/92 

Chicago-O’Hare  Airport, 
Illinois 

United 

Rudder  PCU  anomaly  during 
ground  check 

12/14/92 

San  Diego,  California 

USAir 

Rudder  PCU  malfunction 

01/04/93 

Seattle-Tacoma, 

Washington 

-300 

United 

Hydraulic  block/binding 

04/16/93 

Near  Auckland,  New 
Zealand 

-200 

Air  New 
Zealand 

Yaw  damper  anomaly 

04/23/93 

Stapleton,  Denver, 

Colorado 

-500 

United 

Wake  vortex  encounter  with  a 

757 

06/24/93 

Orly  Airport,  Paris,  France 

-300 

Air  France 

Descent  rudder  deflection 

08/20/93 

France 

-300 

Air  France 

Takeoff  roll  rudder  deflection 

08/22/93 

Oklahoma  City,  Oklahoma 

-200 

Southwest 

Yaw  damper  anomaly 

08/24/93 

France 

-300 

Air  France 

Two  rudder  deflections  in  flight 

11/02/93 

Manila,  Philippines 

-300 

Philippine 

Airlines 

Yaw  damper  anomaly 

03/08/94 

New  Delhi,  India 

-200 

Sahara 

Airlines 

Loss  of  control  during  training 
flight 

03/29/94 


Oakland,  California 


-300 


Southwest 


First  officer  incapacitation 
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Date 

Location 

737 

series 

Carrier 

Cornment/event 

03/31/94 

Las  Vegas,  Nevada 

-300 

America 

West 

Yaw  damper  anomaly 

04/12/94 

San  Pedro  Sula, 

Honduras 

-300 

Continental 

Yaw  damper  anomaly 

05/23/94 

Phoenix,  Arizona 

-200 

America 

West 

Yaw  damper  anomaly 

08/31/94 

London,  Engiand 

-200 

British 

Airways 

Yaw  damper  anomaiy 

09/02/94 

Melbourne,  Australia 

-300 

Ansett 

Yaw  damper  anomaly 

09/08/94 

Aliquippa,  Pennsylvania 

-300 

USAir 

Fiight  427  accident 

09/21/94 

Los  Angeles,  California. 

10/24/94 

Phoenix,  Arizona 

11/24/94 

Phiiadelphia, 

Pennsyivania 

-300 

USAir 

Yaw  damper  anomaly 

12/02/94 

Sacramento,  Caiifornia 

-300 

Southwest 

“Pull  to  left”  on  takeoff  roll 

12/20/94 

Raleigh-Durham,  North 
Carolina 

-300 

USAir 

Yaw  damper  anomaly 

12/21/94 

Coventry,  England 

-200 

Air  Algeria 

CFIT;  mis-set  Instrument 

12/29/94 

Van,  Turkey 

-400 

Turkish 

Airways 

CRT 

01/02/95 

Houston,  Texas 

N/A 

Southwest 

Wake  vortex  encounter  with 

MD-80 

01/13/95 

Jogjakarta,  Indonesia 

-300 

Garuda 

Airlines 

Landing,  runway  overrun 

01/17/95 

Yogyakarta,  Indonesia 

-200 

N/A 

Runway  overrun 

01/20/95 

Atlanta,  Georgia 

-200 

Air  South 

Runway  overrun  on  landing 

01/25/95 

Aibuquerque,  New  Mexico 

-300 

America 

West 

Roll-off  on  takeoff 

02/21/95 

Australia 

-400 

Qantas 

Wake  vortex  encounter  with  a 

747 

03/29/95 

En  route  ONT  to  SJC 

-300 

Southwest 

Yaw  damper  anomaly 
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737 

Date  Location  series  Carrier  Comment/event 

04/08/95  Vittoria,  Brazil  -300  Trans  Brasil  Off  side  of  runway 

04/13/95  Denver  International,  -400  Mark  Air  Hard  landing 

Colorado 

05/05/95  Dublin,  Republic  of  Ireland  -400  Aer  Lingus  Yaw  damper  anomaly 

06/26/95  National  Airport,  -300  USAir  Uncommanded  roll 

Washington,  D.C. 

07/18/95  Ormond  Beach,  Florida  -300  USAir  Uncommanded  roll 

07/25/95  Charlotte,  North  Carolina  -300  USAir  Uncommanded  roll 

07/25/95  Richmond,  Virginia  -400  USAir  Uncommanded  roll 

07/25/95  Mexico  City,  Mexico  -300  Continental  Yaw  damper  anomaly 

07/28/95  London-Heathrow,  United  -400  British  Rudder  on  hard  landing 

Kingdom  Airways 

07/29/95  Love  Field,  Dallas,  Texas  -300  Southwest  Ground  collision 

08/05/95  Charlotte,  North  Carolina  -300  USAir  Uncommanded  roll 

08/09/95  San  Salvador,  El  Salvador  -200  AVIATECA  CFIT 

08/10/95  New  Orleans,  Louisiana  -200  USAir  Uncommanded  roll 

08/1 7/95  Phoenix,  Arizona  -400  USAir  Rudder  after  initial  touchdown 

08/20/95  Toronto,  Ontario,  Canada  -200  Canadian  Yaw  damper  anomaly 

Airlines 

08/25/95  Fort  Lauderdale,  Florida  -300  USAir  Uncommanded  roll 

08/30/95  Cleveland,  Ohio  -300  Continental  Uncommanded  roll 

09/1 2/95  Dallas-Fort  Worth,  Texas  -200  USAir  Uncommanded  pitch-up 

09/25/95  Denver  International,  -200  United  Takeoff  roll  rudder  deflection 

Colorado 

09/29/95  Dayton,  Ohio  -300  USAir  Rudder  trim  runaway 

09/29/95  Charlotte,  North  Carolina  -300  USAir  Wake  vortex  encounter  with  a 

757 

1 0/1 4/95  Dallas-Fort  Worth,  Texas  -300  Delta  Yaw  damper  anomaly 

10/15/95  Boscombe  Down,  England  -200  British  Roll  oscillations;  maintenance 

Airways  flight 
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Date 

Location 

Carrier 

Gomment/event 

10/22/95 

San  Francisco,  California 

-500 

United 

Pitch-up  during  maintenance 
flight 

10/22/95 

Pittsburgh,  Pennsylvania 

-300 

USAir 

Unexpected  roll  on  approach 

10/26/95 

Dusseldorf,  Germany 

-300 

Deutsche 

BA 

Uncommanded  roll 

10/27/95 

Munich,  Germany 

-300 

Deutsche 

BA 

Uncommanded  roll 

10/14/95 

En  route  DFW  to  HSV 

-300 

Delta 

Uncommanded  rudder  Input 

10/29/95 

Portland,  Maine 

-300 

USAir 

Bird  strike  during  takeoff 

10/30/95 

Las  Vegas,  Nevada 

-500 

Southwest 

First  officer  eye  struck  by  laser 
beam 

10/31/95 

En  route  PBI  to  PIT 

-300 

USAir 

Uncommanded  rolls 

11/02/95 

Charlotte,  North  Carolina 

-400 

USAir 

Uncommanded  roll 

11/06/95 

Sydney,  Australia 

-300 

Ansett 

Wake  vortex  encounter  with  a 

747 

11/13/95 

Kaduna,  Nigeria 

-200 

Nigerian 

Airlines 

Runway  overrun 

11/25/95 

Portland,  Oregon 

N/A 

United 

Turbulence  on  approach 

11/29/95 

DeGaulle  Airport,  Paris, 
France 

Gear  failure  on  landing  rollout 

12/02/95 

New  Delhi,  India 

-200 

Indian 

Airlines 

Runway  overrun 

12/03/95 

Douale,  Cameroon 

-200 

Cameroon 

CFIT;  landed  in  a  swamp 

12/28/95 

Toulouse,  France 

-200 

Euralair 

No.  1  engine  failure 

01/02/96  Honolulu,  Hawaii  -200  Aloha  Uncommanded  lateral 

oscillations 


01/18/96 

Melbourne,  Australia 

-400 

Qantas 

Uncommanded  roll 

01/29/96 

Stavanger,  Norway 

-400 

Braathens 

BRT 

Rudder  failsafe  bolt  break 

02/09/96 

Chicago,  Illinois 

-200 

United 

Wake  vortex  encounter  with  a 

727 

02/22/96 

National  Airport, 

Washington,  D.C. 

-100 

Continental 

Runway  overrun 
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Date 

Location 

737 

series 

Carrier 

Comment/event 

02/23/96 

Colorado  Springs, 

Colorado 

N/A 

America 

West 

Clear  air  turbulence  on 
approach 

03/06/96 

Arequipa,  Peru 

-200 

Faucett 

CFIT;  impacted  hill  on  final 

03/13/96 

Philadelphia, 

Pennsylvania 

N/A 

USAir 

Wake  turbulence 

04/01/96 

Chicago,  Illinois 

-300 

Continental 

Wake  vortex  encounter  with  a 

777 

04/07/96 

Approach  to  San 

Francisco,  California 

-300 

United 

Vibration  in  rudder  pedals 

04/28/96 

Denver,  Colorado 

-300 

United 

Engine  failure  after  takeoff 

05/14/96 

Trenton,  New  Jersey 

-200 

Eastwind 

Yaw  “bumps”  on  climbout 

05/25/96 

N/A 

-500 

United 

Yaw  damper  transfer  valve  jam 

05/25/96 

N/A 

-300 

United 

Bent  pin  on  yaw  damper  coupler 

05/25/96 

N/A 

-300 

United 

Yaw  damper  trip/replace  /VP 
access 

06/09/96 

Richmond,  Virginia 

-200 

Eastwind 

Flight  517  incident 

06/22/96 

Granite,  Colorado 

-200 

Frontier 

Clear  air  turbulence  encounter 

06/29/96 

Phoenix,  Arizona 

-300 

America 

West 

Uncommanded  roll 

07/07/96 

Nashville,  Tennessee 

Southwest 

Aborted  takeoff;  bird  ingestion 

07/10/96 

Seattle,  Washington 

Southwest 

Rudder  kick  on  takeoff 

07/14/96 

El  Salvador 

-200 

TACA 

Lateral  oscillations  after  takeoff 

08/29/96 

Chattanooga,  Tennessee 

N/A 

USAir 

Clear  air  turbulence  encounter 

11/16/96 

Phoenix,  Arizona 

-300 

Southwest 

Uncommanded  yaw 

12/12/96 

Frankfurt,  Germany 

-400 

Lufthansa 

Rudder  oscillations  with  PCU 
test 

01/21/97 

Boston,  Massachusetts 

-200 

Delta 

Yaw  damper  anomaly 

03/02/97 

Carajas,  Brazil 

-200 

Varig 

Hard  landing  and  runway 
overrun 

12/19/97 

Palembang,  Indonesia 

-300 

SilkAir 

Loss  of  control;  flight  185 
accident 
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Date 

Location 

737 

series 

Carrier 

Comnient/event 

03/11/98 

Anchorage,  Alaska 

-200 

Arco  Alaska 

Yaw  dannper  anomaly 

03/11/98 

Spokane,  Washington 

-300 

Southwest 

Yaw  damper  anomaly 

07/02/98 

Brazil 

-400 

Trans  Brasil 

Yaw  damper  anomaly 

08/07/98 

En  route  PHL  to  LAS 

-300 

USAirways 

Possible  wake  vortex  encounter 

08/12/98 

En  route  CVG  to  GSO 

-200 

Delta 

Yaw  damper  anomaly 

08/98 

N/A 

-700 

Southwest 

Yaw  excursion  during  takeoff  roll 

08/14/98 

Juneau,  Alaska 

-400 

Alaskan 

Hard  landing 

11/01/98 

Atlanta,  Georgia 

-200 

AirT  ran 

Hydraulic  leak;  maintenance 
flight 

02/19/99 

Seattle,  Washington 

-300 

United 

Anomalous  rudder  response 

02/23/99 

Salisbury,  Maryland 

-200 

Metrojet 

Rudder  hardover  in  flight 

Note:  CFIT,  controlled  flight  into  terrain;  A/P,  autopilot;  ONT, 

Ontario  International  Airport,  California;  SJC,  San  Jose 

International  Airport,  California;  DFW,  Dallas-Fort  Worth  International  Airport,  Texas;  HSV,  Huntsville  International  Airport, 
Alabama;  PBI,  West  Palm  Beach  International  Airport,  Florida;  PIT,  Pittsburgh  International  Airport,  Pennsylvania;  PHL, 
Philadelphia  International  Airport,  Pennsylvania;  LAS,  Las  Vegas  International  Airport,  Nevada;  CVG,  Cincinnati/Northern 
Kentucky  International  Airport,  Covington,  Kentucky;  and  GSO,  Piedmont  Triad  International  Airport,  Greensboro, 
North  Carolina. 
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Appendix  F 

Boeing’s  “Blue  Water”  Assessment  Team 


Since  the  introduction  of  the  Boeing  737  series  airplane,  there  have  been 
maintenance  reports  of  fluid  in  the  electrical/electronic  compartment  (E/E  bay). 
Occasionally,  pilot  reports  of  system  problems  were  later  determined  to  be  caused  by  short 
circuiting  of  electrical  components  in  the  E/E  bay  as  a  result  of  the  presence  of  fluids. 
Because  of  these  events,  Boeing  established  an  assessment  team  (which  included  an  FAA 
engineer)  in  1995  to  investigate  fluid  contamination  of  electrical  and  electrical  boxes  and 
the  interfacing  with  electrical  wiring  and  connectors  within  the  737  E/E  bay. 

The  team  reviewed  equipment  designs,  maintenance  practices,  service  data, 
operator  fleet  campaign  results,  and  E/E  bay  component  overhaul  data  and  performed 
inspections  of  in-service  airplanes.  The  team  reviewed  653  Boeing  737  operator  E/E  bay 
service  reports  from  January  1984  to  February  1996.  Fluid  contamination  was 
documented  in  111  of  these  reports.  The  team  also  reviewed  13,905  service/repair  station 
records  pertaining  to  the  maintenance  of  electrical  boxes.  Fluid-related  contamination  was 
documented  in  366  of  these  reports.  The  team  found  that  the  position  of  a  electrical  box 
did  not  necessarily  protect  it  from  contamination.  The  team  also  found  that  forward 
lavatory  waste  water  was  the  primary  fluid  source  for  E/E  bay  contamination.  The 
assessment  fouftd  that  overservicing  of  the  lavatory,  cracked  toilet  tanks,  failed  gaskets, 
and  damaged  dump  valves  were  the  primary  source  of  the  leaks. 

The  737  series  is  equipped  with  fluid  barrier  systems  that  are  designed  to  contain 
or  prevent  fluids  from  reaching  the  E/E  bay.  These  barriers  include  the  floor  panel 
moisture  barrier,  shrouds,  and  airstair  drip  pan.  However,  the  assessment  team  found  that 
the  barriers  can  be  damaged  during  service,  allowing  fluids  to  enter  the  E/E  bay.  The 
examination  of  several  airplanes  found  that  some  shroud  installations  were  completely 
missing;  some  were  damaged,  contaminated,  or  tom;  and  some  were  improperly  installed. 

The  assessment  team  identified  improvements  aimed  at  preventing  fluid  leakage 
and  contaminated  electrical  and  electronic  equipment.  The  team  reported  that  it  did  not 
identify  any  substantial  design  deficiencies  or  common  problems;  however,  it  found  that 
operator-specific  maintenance  and  service  practices  may  compromise  the  effectiveness  of 
the  moisture  barrier  systems. 

The  team’s  October  1996  final  report  indicated  that  the  team  did  not  uncover  any 
evidence  that  a  specific  fluid  leakage  event  would  produce  a  near-term,  unexpected, 
aircraft  flightpath  departure.  However,  the  team  made  several  recommendation  to  reduce 
the  potential  for  fluid  leakage  into  the  E/E  bay  in  737  airplanes  and  noted  any  pertinent 
corrective  actions.  These  recommendations  included  the  following: 
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•  Installation  of  a  forward  waste  system  flush/fill  line  shutoff  valve  and  fluid 
sensor. 

•  Installation  of  an  improved  airstair  drip  pan  access  hatch  gasket.  (Addressed  by 
Boeing  Service  Letter  737-SL-53-23,  dated  June  28,  1993.) 

•  Elimination  of  the  E/E  rack  moisture  shroud  lack  of  coverage  by  verifying  that 
the  shroud  is  properly  installed  and  incorporating  an  improved  moisture 
shroud.  (Boeing  Service  Bulletin  737-25-1317  was  released  to  all  operators, 
providing  information  regarding  the  replacement  of  the  cloth  moisture  shroud 
with  one  manufactured  from  aluminum.  Boeing  determined  that  an 
improvement  to  the  aluminum  moisture  sJiroud  would  increase  the  protection; 
therefore,  once  the  improved  moisture  shroud  parts  are  available.  Service 
Bulletin  737-25-1317  will  be  superceded.) 

•  Incorporation  of  an  improved  floor  moisture  barrier  system.  (Boeing  Service 
Letter  737-SL-53-034-B,  dated  February  21,  1997,  provides  for  the 
modification  of  airplanes  manufactured  before  January  1996.) 

•  Periodic  inspection  of  the  E/E  bay  moisture  shrouds  and  drip  pans.  (Temporary 
revisions  to  sections  25-51-01  of  the  Boeing  Maintenance  Manual  were 
released  in  July  1998  for  737-300,  -400,  and  -500  series  airplanes  and  in 
August  1998  for  the  -100  and  -200  series  airplanes.  In  November  1997,  a 
revision  to  the  maintenance  planning  document  was  released  for  the  737-300, 
-400,  and  -500  series  airplanes,  including  a  task  to  visually  check  the  moisture 
shrouds  and  drip  pans  for  obvious  damage  at  every  “IC”  maintenance  interval 
(MPD  item  B25-51-00-6A).  The  document  is  no  longer  being  revised  by 
Boeing  for  the  -100  and  -200  airplanes;  however,  operators  of  these  airplanes 
were  asked  to  incorporate  the  intent  of  the  subject  task  item  into  their 
maintenance  programs. 

•  Periodic  inspection  of  lavatory  system  for  signs  of  leakage.  (Inspection 
procedures  were  added  to  section  38-32-0  of  the  Boeing  Maintenance  Manual.) 


